The crash no longer occurs, seems OK. Also, and as expected, I've been unable to find any more issues at this time, so there are no more upcoming reports from me. Thanks for your prompt fixes.

Crash tested with ftbench (current git branch of freetype2 and ft2demos), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Because of the nature of the vulnerability (64-to-32 bit integer truncation), the issue might only be reproducible on 64-bit platforms.

Crashlog:

(gdb) r tmp/freetype_run2/30000.11181.otf.9f7.35
Starting program: ft2demos-2.4.8/bin/ftbench tmp/freetype_run2/30000.11181.otf.9f7.35
tt_face_build_cmaps: broken cmap sub-table ignored
tt_face_build_cmaps: broken cmap sub-table ignored

Program received signal SIGFPE, Arithmetic exception.
0x0000000000403984 in FT_DivFix (a=0, b=16106127360000000) at freetype2/src/base/ftcalc.c:555
555         q = (FT_UInt32)( (a << 16) + (b >> 1) ) / (FT_UInt32)b;
(gdb) where
#0  0x0000000000403984 in FT_DivFix (a=0, b=16106127360000000)
    at freetype2/src/base/ftcalc.c:555
#1  0x0000000000437ae7 in cff_face_init (stream=0x6ce960, cffface=0x6cec00, face_index=0, num_params=0, params=0x0)
    at freetype2/src/cff/cffobjs.c:659
#2  0x0000000000407f70 in open_face (driver=0x6cdd70, stream=0x6ce960, face_index=0, num_params=0, params=0x0,
    aface=0x7fffffffe108) at freetype2/src/base/ftobjs.c:1153
#3  0x00000000004097f4 in FT_Open_Face (library=0x6c9040, args=0x7fffffffe180, face_index=0, aface=0x7fffffffe2a0)
    at freetype2/src/base/ftobjs.c:2080
#4  0x000000000040808d in FT_New_Face (library=0x6c9040,
    pathname=0x7fffffffe654 "tmp/freetype_run2/30000.11181.otf.9f7.35", face_index=0,
    aface=0x7fffffffe2a0) at freetype2/src/base/ftobjs.c:1215
#5  0x0000000000402303 in get_face (face=0x7fffffffe2a0) at src/ftbench.c:624
#6  0x00000000004025f5 in main (argc=1, argv=0x7fffffffe3b0) at src/ftbench.c:752
(gdb)