--- freetype-2.3.11/src/bdf/bdflib.c 2012-04-02 16:24:56.000000000 +0200 +++ freetype-2.3.11/src/bdf/bdflib.c 2012-04-02 16:25:33.000000000 +0200 @@ -1870,7 +1870,7 @@ glyph->bpr = ( glyph->bbx.width * p->font->bpp + 7 ) >> 3; bitmap_size = glyph->bpr * glyph->bbx.height; - if ( bitmap_size > 0xFFFFU ) + if ( glyph->bpr > 0xFFFFU || bitmap_size > 0xFFFFU ) { FT_ERROR(( "_bdf_parse_glyphs: " ERRMSG4, lineno )); error = BDF_Err_Bbx_Too_Big;