  cff_parse_fixed( CFF_Parser  parser,
                   FT_Byte**   d )
  {
    return do_fixed( parser, d, 0 );
  }

The product writes data past the end, or before the beginning, of the intended buffer.