--- freetype-2.2.1/src/psaux/psobjs.c~	2006-04-26 16:38:17.000000000 +0200
+++ freetype-2.2.1/src/psaux/psobjs.c	2006-09-10 15:01:13.000000000 +0200
@@ -165,6 +165,11 @@
       return PSaux_Err_Invalid_Argument;
     }
 
+    if ( length < 0 ) {
+      FT_ERROR(( "ps_table_add: invalid length\n" ));
+      return PSaux_Err_Invalid_Argument;
+    }
+
     /* grow the base block if needed */
     if ( table->cursor + length > table->capacity )
     {