Found with libFuzzer+AddressSanitizer with FreeType 3cfd51233c8b88f53097ebcef6bbb05e360d12b7, reproduction attached. This appears to be a read off the end of the input. The error is reported as:

ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6230001a743a at pc 0x000000895f6d bp 0x7ffc560afaf0 sp 0x7ffc560afae8
READ of size 1 at 0x6230001a743a thread T0
    #0 0x895f6c in t42_parse_sfnts src/freetype2/src/type42/t42parse.c:685:39
    #1 0x887f15 in t42_load_keyword src/freetype2/src/type42/t42parse.c:1082:7
    #2 0x887f15 in t42_parse_dict src/freetype2/src/type42/t42parse.c:1229
    #3 0x887f15 in T42_Open_Face src/freetype2/src/type42/t42objs.c:63
    #4 0x887f15 in T42_Face_Init src/freetype2/src/type42/t42objs.c:202
    #5 0x5f8019 in open_face src/freetype2/src/base/ftobjs.c:1177:15
    #6 0x5f4fba in FT_Open_Face src/freetype2/src/base/ftobjs.c:2175:19
    #7 0x5f77ac in FT_New_Memory_Face src/freetype2/src/base/ftobjs.c:1267:12
    #8 0x4daa5b in LLVMFuzzerTestOneInput (fuzz_freetype/freetype2_fuzzer+0x4daa5b)

0x6230001a743a is located 0 bytes to the right of 5946-byte region [0x6230001a5d00,0x6230001a743a)
allocated by thread T0 here:
    #0 0x4d87eb in operator new(unsigned long) src/llvm_all/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:62:35
    #1 0x4e4191 in __gnu_cxx::new_allocator<unsigned char>::allocate(unsigned long, void const*) (fuzz_freetype/freetype2_fuzzer+0x4e4191)
    #2 0x4e1654 in std::_Vector_base<unsigned char, std::allocator<unsigned char> >::_M_allocate(unsigned long) (fuzz_freetype/freetype2_fuzzer+0x4e1654)
    #3 0x4e8d61 in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_range_initialize<unsigned char const*>(unsigned char const*, unsigned char const*, std::forward_iterator_tag) (fuzz_freetype/freetype2_fuzzer+0x4e8d61)
    #4 0x4e8b8b in void std::vector<unsigned char, std::allocator<unsigned char> >::_M_initialize_dispatch<unsigned char const*>(unsigned char const*, unsigned char const*, std::__false_type) (fuzz_freetype/freetype2_fuzzer+0x4e8b8b)
    #5 0x4e890c in std::vector<unsigned char, std::allocator<unsigned char> >::vector<unsigned char const*, void>(unsigned char const*, unsigned char const*, std::allocator<unsigned char> const&) (fuzz_freetype/freetype2_fuzzer+0x4e890c)
    #6 0x4e8737 in void __gnu_cxx::new_allocator<std::vector<unsigned char, std::allocator<unsigned char> > >::construct<std::vector<unsigned char, std::allocator<unsigned char> >, unsigned char const*&, unsigned char const*>(std::vector<unsigned char, std::allocator<unsigned char> >*, unsigned char const*&, unsigned char const*&&) (fuzz_freetype/freetype2_fuzzer+0x4e8737)
    #7 0x4e854b in ZNSt16allocator_traitsISaISt6vectorIhSaIhEEEE12_S_constructIS2_JRPKhS7_EEENSt9enable_ifIXsr18__construct_helperIT_DpT0_EE5valueEvE4typeERS3_PSA_DpOSB (fuzz_freetype/freetype2_fuzzer+0x4e854b)
    #8 0x4e7c6b in ZNSt16allocator_traitsISaISt6vectorIhSaIhEEEE9constructIS2_JRPKhS7_EEEDTcl12_S_constructfp_fp0_spclsr3stdE7forwardIT0_Efp1_EEERS3_PT_DpOS9 (fuzz_freetype/freetype2_fuzzer+0x4e7c6b)
    #9 0x4e7dfa in void std::vector<std::vector<unsigned char, std::allocator<unsigned char> >, std::allocator<std::vector<unsigned char, std::allocator<unsigned char> > > >::_M_emplace_back_aux<unsigned char const*&, unsigned char const*>(unsigned char const*&, unsigned char const*&&) (fuzz_freetype/freetype2_fuzzer+0x4e7dfa)
    #10 0x4de511 in void std::vector<std::vector<unsigned char, std::allocator<unsigned char> >, std::allocator<std::vector<unsigned char, std::allocator<unsigned char> > > >::emplace_back<unsigned char const*&, unsigned char const*>(unsigned char const*&, unsigned char const*&&) (fuzz_freetype/freetype2_fuzzer+0x4de511)
    #11 0x4dc5d4 in parse_data(unsigned char const*, unsigned long) (fuzz_freetype/freetype2_fuzzer+0x4dc5d4)
    #12 0x4da96d in LLVMFuzzerTestOneInput (fuzz_freetype/freetype2_fuzzer+0x4da96d)

SUMMARY: AddressSanitizer: heap-buffer-overflow src/freetype2/src/type42/t42parse.c:685:39 in t42_parse_sfnts
Shadow bytes around the buggy address:
  0x0c468002ce30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c468002ce40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c468002ce50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c468002ce60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c468002ce70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c468002ce80: 00 00 00 00 00 00 00[02]fa fa fa fa fa fa fa fa
  0x0c468002ce90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c468002cea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c468002ceb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c468002cec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c468002ced0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb