diff -up freetype-2.2.1/src/cff/cffload.c.2009-CVEs freetype-2.2.1/src/cff/cffload.c
--- freetype-2.2.1/src/cff/cffload.c.2009-CVEs	2006-03-21 13:17:26.000000000 -0500
+++ freetype-2.2.1/src/cff/cffload.c	2009-04-20 15:09:37.000000000 -0400
@@ -1550,7 +1550,20 @@
             goto Exit;
 
           for ( j = 1; j < num_glyphs; j++ )
-            charset->sids[j] = FT_GET_USHORT();
+          {
+            FT_UShort sid = FT_GET_USHORT();
+
+
+            /* this constant is given in the CFF specification */
+            if ( sid < 65000 )
+              charset->sids[j] = sid;
+            else
+            {
+              FT_ERROR(( "cff_charset_load:"
+                         " invalid SID value %d set to zero\n", sid ));
+              charset->sids[j] = 0;
+            }
+          }
 
           FT_FRAME_EXIT();
         }
@@ -1583,6 +1596,20 @@
                 goto Exit;
             }
 
+            /* check whether the range contains at least one valid glyph; */
+            /* the constant is given in the CFF specification             */
+            if ( glyph_sid >= 65000 ) {
+              FT_ERROR(( "cff_charset_load: invalid SID range\n" ));
+              error = CFF_Err_Invalid_File_Format;
+              goto Exit;
+            }
+
+            /* try to rescue some of the SIDs if `nleft' is too large */
+            if ( nleft > 65000 - 1 || glyph_sid >= 65000 - nleft ) {
+              FT_ERROR(( "cff_charset_load: invalid SID range trimmed\n" ));
+              nleft = 65000 - 1 - glyph_sid;
+            }
+
             /* Fill in the range of sids -- `nleft + 1' glyphs. */
             for ( i = 0; j < num_glyphs && i <= nleft; i++, j++, glyph_sid++ )
               charset->sids[j] = glyph_sid;
diff -up freetype-2.2.1/src/lzw/ftzopen.c.2009-CVEs freetype-2.2.1/src/lzw/ftzopen.c
--- freetype-2.2.1/src/lzw/ftzopen.c.2009-CVEs	2006-05-02 17:52:44.000000000 -0400
+++ freetype-2.2.1/src/lzw/ftzopen.c	2009-04-20 15:09:37.000000000 -0400
@@ -309,6 +309,9 @@
 
           while ( code >= 256U )
           {
+            if ( !state->prefix )
+              goto Eof;
+
             FTLZW_STACK_PUSH( state->suffix[code - 256] );
             code = state->prefix[code - 256];
           }
diff -up freetype-2.2.1/src/sfnt/ttcmap.c.2009-CVEs freetype-2.2.1/src/sfnt/ttcmap.c
--- freetype-2.2.1/src/sfnt/ttcmap.c.2009-CVEs	2009-04-20 15:09:37.000000000 -0400
+++ freetype-2.2.1/src/sfnt/ttcmap.c	2009-04-20 15:09:37.000000000 -0400
@@ -1555,7 +1555,7 @@
       FT_INVALID_TOO_SHORT;
 
     length = TT_NEXT_ULONG( p );
-    if ( table + length > valid->limit || length < 8208 )
+    if ( length > (FT_UInt32)( valid->limit - table ) || length < 8192 + 16 )
       FT_INVALID_TOO_SHORT;
 
     is32       = table + 12;
@@ -1780,7 +1780,8 @@
     p      = table + 16;
     count  = TT_NEXT_ULONG( p );
 
-    if ( table + length > valid->limit || length < 20 + count * 2 )
+    if ( length > (FT_ULong)( valid->limit - table ) ||
+         length < 20 + count * 2                     )
       FT_INVALID_TOO_SHORT;
 
     /* check glyph indices */
@@ -1962,7 +1963,8 @@
     p          = table + 12;
     num_groups = TT_NEXT_ULONG( p );
 
-    if ( table + length > valid->limit || length < 16 + 12 * num_groups )
+    if ( length > (FT_ULong)( valid->limit - table ) ||
+         length < 16 + 12 * num_groups               )
       FT_INVALID_TOO_SHORT;
 
     /* check groups, they must be in increasing order */
diff -up freetype-2.2.1/src/smooth/ftsmooth.c.2009-CVEs freetype-2.2.1/src/smooth/ftsmooth.c
--- freetype-2.2.1/src/smooth/ftsmooth.c.2009-CVEs	2005-05-11 11:02:05.000000000 -0400
+++ freetype-2.2.1/src/smooth/ftsmooth.c	2009-04-20 15:12:55.000000000 -0400
@@ -149,7 +149,7 @@
       slot->internal->flags &= ~FT_GLYPH_OWN_BITMAP;
     }
 
-    /* allocate new one, depends on pixel format */
+    /* allocate new one */
     pitch = width;
     if ( hmul )
     {
@@ -160,6 +160,13 @@
     if ( vmul )
       height *= vmul;
 
+    if ( pitch > 0xFFFF || height > 0xFFFF )
+    {
+      FT_ERROR(( "ft_smooth_render_generic: glyph too large: %d x %d\n",
+                 width, height ));
+      return Smooth_Err_Raster_Overflow;
+    }
+
     bitmap->pixel_mode = FT_PIXEL_MODE_GRAY;
     bitmap->num_grays  = 256;
     bitmap->width      = width;