Crash tested with ftbench (freetype2 and ft2demos git upstream), compiled under Ubuntu amd64 with AddressSanitizer (http://code.google.com/p/address-sanitizer/).

Log from ASAN build:

(gdb) r
Starting program: ft2demos-2.4.10/bin/.libs/ftbench zgraphics_r400-12.bdf.SIGSEGV.dbf.2501
[Thread debugging using libthread_db enabled]
Using host libthread_db library "libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x000000000074109e in bdf_free_font (font=<optimized out>)
    at freetype2/src/bdf/bdflib.c:2543
2543          if ( font->props[i].format == BDF_ATOM )
(gdb) where
#0  0x000000000074109e in bdf_free_font (font=<optimized out>)
    at freetype2/src/bdf/bdflib.c:2543
#1  0x0000000000747061 in bdf_load_font (stream=<optimized out>, extmemory=<optimized out>, opts=<optimized out>,
    font=<optimized out>) at freetype2/src/bdf/bdflib.c:2504
#2  0x0000000000737a53 in BDF_Face_Init (stream=<optimized out>, bdfface=<optimized out>, face_index=<optimized out>,
    num_params=<optimized out>, params=<optimized out>) at freetype2/src/bdf/bdfdrivr.c:367
#3  0x000000000044e086 in open_face (driver=<optimized out>, stream=<optimized out>, face_index=<optimized out>,
    num_params=<optimized out>, params=<optimized out>, aface=<optimized out>)
    at freetype2/src/base/ftobjs.c:1154
#4  0x0000000000449dc2 in FT_Open_Face (library=<optimized out>, args=<optimized out>, face_index=<optimized out>,
    aface=<optimized out>) at freetype2/src/base/ftobjs.c:2082
#5  0x0000000000448070 in FT_New_Face (library=<optimized out>, pathname=<optimized out>, face_index=<optimized out>,
    aface=<optimized out>) at freetype2/src/base/ftobjs.c:1216
#6  0x0000000000416757 in get_face (face=<optimized out>)
    at ft2demos-2.4.10/src/ftbench.c:624
#7  0x0000000000418a73 in main (argc=<optimized out>, argv=<optimized out>)
    at ft2demos-2.4.10/src/ftbench.c:752
(gdb) x/10i $rip
=> 0x74109e <bdf_free_font+2526>:       cmpl   $0x1,(%rax)
   0x7410a4 <bdf_free_font+2532>:       jne    0x741333 <bdf_free_font+3187>
   0x7410aa <bdf_free_font+2538>:       jmpq   0x7410af <bdf_free_font+2543>
   0x7410af <bdf_free_font+2543>:       mov    0x2f0(%rsp),%rax
   0x7410b7 <bdf_free_font+2551>:       shr    $0x3,%rax
   0x7410bb <bdf_free_font+2555>:       movabs $0x100000000000,%rcx
   0x7410c5 <bdf_free_font+2565>:       or     %rcx,%rax
   0x7410c8 <bdf_free_font+2568>:       cmpb   $0x0,(%rax)
   0x7410cb <bdf_free_font+2571>:       je     0x7410de <bdf_free_font+2590>
   0x7410d1 <bdf_free_font+2577>:       mov    0x2f0(%rsp),%rdi
(gdb) info reg
rax            0x8      8
rbx            0x100000000000   17592186044416
rcx            0x8      8
rdx            0x0      0
rsi            0x100000000001   17592186044417
rdi            0x100000000000   17592186044416
rbp            0x7fffffffad70   0x7fffffffad70
rsp            0x7fffffffa8e0   0x7fffffffa8e0
r8             0x7fffffffa800   140737488332800
r9             0x1ffffffff504   35184372086020
r10            0x100000000000   17592186044416
r11            0x7ffff728ef6a   140737340043114
r12            0x7fffffffb4a0   140737488336032
r13            0x7fffffffb4e0   140737488336096
r14            0x7fffffffb420   140737488335904
r15            0x7fffffffb460   140737488335968
rip            0x74109e 0x74109e <bdf_free_font+2526>
eflags         0x10246  [ PF ZF IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0
(gdb)