--- freetype-2.3.11/src/truetype/ttinterp.c 2009-07-31 18:45:19.000000000 +0200 +++ freetype-2.3.11/src/truetype/ttinterp.c 2010-07-15 14:44:23.000000000 +0200 @@ -6466,8 +6466,8 @@ end_point = CUR.pts.contours[contour] - CUR.pts.first_point; first_point = point; - if ( CUR.pts.n_points <= end_point ) - end_point = CUR.pts.n_points; + if ( BOUNDS ( end_point, CUR.pts.n_points ) ) + end_point = CUR.pts.n_points - 1; while ( point <= end_point && ( CUR.pts.tags[point] & mask ) == 0 ) point++;