I can reproduce locally and surprisingly this bisects to 8ef8072ba15 "[bdf, cid, pfr, winfonts] Improve rejection of other font formats." Will take a quick look.
Valgrind is reporting an uninitialized value in _bdf_readstream for
certain (very broken) fonts in my xpdf regression testing on Linux.
I'm attaching a sample font. It's essentially garbage (pulled out of a
damaged PDF file), but I think the uninitialized value is still a
To reproduce: valgrind ftview 16 f1.cff
==22204== Conditional jump or move depends on uninitialised value(s)
==22204== at 0x4E84410: _bdf_readstream (bdflib.c:577)
==22204== by 0x4E84410: bdf_load_font (bdflib.c:2196)
==22204== by 0x4E84410: BDF_Face_Init (bdfdrivr.c:376)
==22204== by 0x4E51B2A: open_face (ftobjs.c:1465)
==22204== by 0x4E53062: ft_open_face_internal (ftobjs.c:2537)
==22204== by 0x4E5342B: FT_New_Face (ftobjs.c:1528)
==22204== by 0x407FCF: FTDemo_Install_Font (ftcommon.c:543)
==22204== by 0x403226: main (ftview.c:1809)
This is new as of 2.11.1.