Found with font fuzzying. * src/psaux/t1decode.c (t1_decoder_parse_charstrings): Check `decoder->buildchar'. * src/type1/t1load.c (t1_load_keyword): Check `blend->num_designs'.