diff -Naur freetype-2.3.2/src/truetype/ttgload.c freetype-2.3.2-m32/src/truetype/ttgload.c
--- freetype-2.3.2/src/truetype/ttgload.c	2007-02-01 08:36:16.000000000 +0100
+++ freetype-2.3.2-m32/src/truetype/ttgload.c	2007-05-22 21:49:12.000000000 +0200
@@ -271,7 +271,11 @@
 
     n_points = 0;
     if ( n_contours > 0 )
+    {
       n_points = cont[-1] + 1;
+      if ( n_points < 0 )
+        goto Invalid_Outline;
+    }
 
     /* note that we will add four phantom points later */
     error = FT_GLYPHLOADER_CHECK_POINTS( gloader, n_points + 4, 0 );
@@ -682,7 +686,7 @@
     FT_GlyphLoader  gloader = loader->gloader;
     FT_Error        error   = TT_Err_Ok;
     FT_Outline*     outline;
-    FT_UInt         n_points;
+    FT_Int          n_points;
 
 
     outline  = &gloader->current.outline;
@@ -709,7 +713,7 @@
       /* Deltas apply to the unscaled data. */
       FT_Vector*  deltas;
       FT_Memory   memory = loader->face->memory;
-      FT_UInt     i;
+      FT_Int      i;
 
 
       error = TT_Vary_Get_Glyph_Deltas( (TT_Face)(loader->face),