Crash tested with ftbench and upstream freetype2, compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/):

./ftbench -p font.bin

Log from ASAN build:

=================================================================
==6515== ERROR: AddressSanitizer heap-buffer-overflow on address 0x7f6bfbeac630 at pc 0x4df88e bp 0x7fffd2f6de70 sp 0x7fffd2f6de68
READ of size 1 at 0x7f6bfbeac630 thread T0
  #0 0x4df88e parse_encoding
  #1 0x4ef246 t1_load_keyword
  #2 0x4ed1e6 parse_dict
  #3 0x4eaa3f T1_Open_Face
  #4 0x4e41d4 T1_Face_Init
  #5 0x49ad82 open_face
  #6 0x499b7b FT_Open_Face
  #7 0x49aa0a FT_New_Memory_Face
  #8 0x490ed4 get_face
  #9 0x49175d main
  #10 0x7f6bfc6f2d5d __libc_start_main
0x7f6bfbeac630 is located 0 bytes to the right of 432-byte region [0x7f6bfbeac480,0x7f6bfbeac630)
allocated by thread T0 here:
  #0 0x5cdf81 __interceptor_malloc
  #1 0x490e05 get_face
  #2 0x49175d main
  #3 0x7f6bfc6f2d5d __libc_start_main
==6515== ABORTING
Stats: 0M malloced (0M for red zones) by 709 calls
Stats: 0M realloced by 0 calls
Stats: 0M freed by 20 calls
Stats: 0M really freed by 0 calls
Stats: 24M (6146 full pages) mmaped in 6 calls
  mmaps   by size class: 8:16383; 9:8191; 10:4095; 11:2047; 12:1024; 15:128;
  mallocs by size class: 8:677; 9:16; 10:5; 11:5; 12:5; 15:1;
  frees   by size class: 8:16; 10:1; 11:2; 12:1;
  rfrees  by size class:
Stats: malloc large: 0 small slow: 7
Shadow byte and word:
  0x1fed7f7d58c6: fb
  0x1fed7f7d58c0: 00 00 00 00 00 00 fb fb
More shadow bytes:
  0x1fed7f7d58a0: 00 00 00 00 00 00 00 00
  0x1fed7f7d58a8: 00 00 00 00 00 00 00 00
  0x1fed7f7d58b0: 00 00 00 00 00 00 00 00
  0x1fed7f7d58b8: 00 00 00 00 00 00 00 00
=>0x1fed7f7d58c0: 00 00 00 00 00 00 fb fb
  0x1fed7f7d58c8: fb fb fb fb fb fb fb fb
  0x1fed7f7d58d0: fa fa fa fa fa fa fa fa
  0x1fed7f7d58d8: fa fa fa fa fa fa fa fa
  0x1fed7f7d58e0: fa fa fa fa fa fa fa fa

A more detailed stack trace:

(gdb) where
#0  __asan_report_load1 () at address_sanitizer/asan/asan_rtl.cc:283
#1  0x00000000004df88e in parse_encoding (face=<optimized out>, loader=<optimized out>)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:1287
#2  0x00000000004ef246 in t1_load_keyword (face=0x7ffff6b86630, loader=0x48df13, field=<optimized out>)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:937
#3  0x00000000004ed1e6 in parse_dict (face=0x7ffff6b86880, loader=0x7fffffffd680, base=<optimized out>, size=<optimized out>)
    at freetype2/freetype-2.4.9/src/type1/t1load.c:2002
#4  0x00000000004eaa3f in T1_Open_Face (face=0x7fffffffd590) at freetype2/freetype-2.4.9/src/type1/t1load.c:2110
#5  0x00000000004e41d4 in T1_Face_Init (stream=<optimized out>, t1face=0x7fffffffd9f0, face_index=4858825, num_params=-1536,
    params=0x7ffff6b86630) at freetype2/freetype-2.4.9/src/type1/t1objs.c:339
#6  0x000000000049ad82 in open_face (driver=0x7ffff736e980, stream=0x7ffff7370080, face_index=0, num_params=0, params=0x0,
    aface=0x7fffffffddc0) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1153
#7  0x0000000000499b7b in FT_Open_Face (library=0x7ffff6f86880, args=0x7fffffffdec0, face_index=0, aface=0x7fffffffe040)
    at freetype2/freetype-2.4.9/src/base/ftobjs.c:2080
#8  0x000000000049aa0a in FT_New_Memory_Face (library=0x7ffff6b86630, file_base=<optimized out>, file_size=<optimized out>,
    face_index=<optimized out>, aface=0x7ffff6b86630) at freetype2/freetype-2.4.9/src/base/ftobjs.c:1242
#9  0x0000000000490ed4 in get_face (face=0x7f5378) at freetype2/ft2demos-2.4.8/src/ftbench.c:621
#10 0x000000000049175d in main (argc=<optimized out>, argv=<optimized out>) at freetype2/ft2demos-2.4.8/src/ftbench.c:752