Index: freetype-2.2.1/src/pcf/pcfread.c
===================================================================
--- freetype-2.2.1.orig/src/pcf/pcfread.c	2006-07-26 12:59:30.000000000 +0200
+++ freetype-2.2.1/src/pcf/pcfread.c	2006-07-26 12:59:46.000000000 +0200
@@ -439,6 +439,14 @@
 
     for ( i = 0; i < nprops; i++ )
     {
+      /* 2006:0500 (mbarnes) - Detect invalid string length.
+       * XXX Is this is best error code to return? */
+      if ( props[i].name < 0 )
+      {
+        error = FT_Err_Invalid_File_Format;
+        goto Bail;
+      }
+
       /* XXX: make atom */
       if ( FT_NEW_ARRAY( properties[i].name,
                          ft_strlen( strings + props[i].name ) + 1 ) )
@@ -451,6 +459,14 @@
 
       if ( props[i].isString )
       {
+	/* 2006:0500 (mbarnes) - Detect invalid string length.
+         * XXX Is this the best error code to return? */
+        if ( props[i].value < 0 )
+        {
+          error = FT_Err_Invalid_File_Format;
+          goto Bail;
+        }
+
         if ( FT_NEW_ARRAY( properties[i].value.atom,
                            ft_strlen( strings + props[i].value ) + 1 ) )
           goto Bail;
