I am pretty sure, just re-confirmed with the following .sh script and valgrind.

==34337== Invalid read of size 1
==34337==    at 0x422651: T1_Get_Private_Dict (t1parse.c:377)
==34337==    by 0x422651: T1_Open_Face (t1load.c:2118)
==34337==    by 0x422F40: T1_Face_Init (t1objs.c:339)
==34337==    by 0x40FA41: open_face (ftobjs.c:1166)
==34337==    by 0x4112F2: FT_Open_Face (ftobjs.c:2156)
==34337==    by 0x411908: FT_New_Memory_Face (ftobjs.c:1256)
==34337==    by 0x4089D6: TestOneInput (repro.c:10)
==34337==    by 0x408AF7: main (repro.c:28)
==34337==  Address 0x69c9360 is 0 bytes after a block of size 256 alloc'd
==34337==    at 0x4C2ABBD: malloc (vg_replace_malloc.c:296)
==34337==    by 0x408ACB: main (repro.c:26)



#!/bin/bash

git clone git://git.sv.nongnu.org/freetype/freetype2.git
cd freetype2/
./autogen.sh
./configure
make -j
cat << EOF > repro.c
#include <ft2build.h>
#include FT_FREETYPE_H
#include <assert.h>
#include <stdlib.h>
#include <string.h>
static FT_Library  library;
void TestOneInput(const unsigned char *data, size_t size) {
  FT_Face face;
  if (size < 1) return;
  if (!FT_New_Memory_Face(library, data, size, 0, &face)) {
    FT_Done_Face(face);
  }
}
unsigned char a[1 << 24];
int main(int argc, char **argv) {
  if (FT_Init_FreeType(&library)) {
    printf("Could not initialize library.\n");
    return 1;
  }
  assert(argc == 2);
  FILE *f = fopen(argv[1], "r");
  assert(f);
  size_t n = fread(a, 1, sizeof(a), f);
  assert(n > 0);
  fclose(f);
  unsigned char b = (unsigned char )malloc(n);
  memcpy(b, a, n);
  TestOneInput(b, n);
  free(b);
}
EOF


gcc -g repro.c -Iinclude ./objs/.libs/libfreetype.a -lbz2 -lz -lpng -lharfbuzz -o repro_vg

cat << EOF | base64 --decode > input
JSFGb250VHlwZTEtMS4xKDogSGdyc2hleS1QbGFpbi1EdXBsZXgtSXRhMItsaWM0IAo7DTFkaWN0
ZWIoZyBpbg2dCi9QYWludFR5ZXBmMSAgZWQNCi9TdHLWb2tlV2lkdGggNjEgZGYNCi9Gb250VHkw
ICBlcGRlZg0KL0Y7bnRBbmZvDQo4JGRpdCAgZXBiZHUlIVBTLVRydWVUeXBFRm9udAo8JXlwZVNz
aSUhUFMtVHJ1ZVR5cCUhRm9udFR5ZUZvbnl0cAolZTElLTEuOjAgL1RUQTVBcG9uOiAzLjowM2du
DQovTm90aWNlIEEgRnIpOW8wZWV4ZWNBNDMgZQ==
EOF

valgrind ./repro_vg input

found on fresh git with libFuzzer+AddressSanitizer
This one looks similar to #45923, but reproduces both before and after its fix.

Feed the data below (base64-encoded) into FT_New_Memory_Face

==12952==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000a000 at pc 0x00000042747a bp 0x7ffe8d4b5cb0 sp 0x7ffe8d4b5468
READ of size 2 at 0x61100000a000 thread T0
    #0 0x427479 in __interceptor_strncmp
    #1 0x52a2f5 in T1_Get_Private_Dict src/type1/t1parse.c:377:29
    #2 0x52a2f5 in T1_Open_Face src/type1/t1load.c:2118
    #3 0x52a2f5 in T1_Face_Init src/type1/t1objs.c:339
    #4 0x4df044 in open_face src/base/ftobjs.c:1166:15
    #5 0x4ddb7f in FT_Open_Face src/base/ftobjs.c:2156:19
    #6 0x4decdc in FT_New_Memory_Face src/base/ftobjs.c:1256:12

0x61100000a000 is located 0 bytes to the right of 256-byte region [0x611000009f00,0x61100000a000)
allocated by thread T0 here:
    #0 0x4abe2b in malloc
    #1 0x4d4713 in main

JSFGb250VHlwZTEtMS4xKDogSGdyc2hleS1QbGFpbi1EdXBsZXgtSXRhMItsaWM0IAo7DTFkaWN0
ZWIoZyBpbg2dCi9QYWludFR5ZXBmMSAgZWQNCi9TdHLWb2tlV2lkdGggNjEgZGYNCi9Gb250VHkw
ICBlcGRlZg0KL0Y7bnRBbmZvDQo4JGRpdCAgZXBiZHUlIVBTLVRydWVUeXBFRm9udAo8JXlwZVNz
aSUhUFMtVHJ1ZVR5cCUhRm9udFR5ZUZvbnl0cAolZTElLTEuOjAgL1RUQTVBcG9uOiAzLjowM2du
DQovTm90aWNlIEEgRnIpOW8wZWV4ZWNBNDMgZQ==