FontFileFreeDir (FontDirectoryPtr dir)
{
    FontFileFreeTable (&dir->scalable);
    FontFileFreeTable (&dir->nonScalable);
    free(dir);
}

The product reads data past the end, or before the beginning, of the intended buffer.