void gx_ttfReader__destroy(gx_ttfReader *self)
{
    gs_free_object(self->memory, self, "gx_ttfReader__destroy");
}

The product reads data past the end, or before the beginning, of the intended buffer.