FontFileFreeTable (FontTablePtr table)
{
    int	i;

    for (i = 0; i < table->used; i++)
	FontFileFreeEntry (&table->entries[i]);
    free (table->entries);
}

The product reads data past the end, or before the beginning, of the intended buffer.