Index: freetype-2.3.5/src/sfnt/ttmtx.c
===================================================================
--- freetype-2.3.5.orig/src/sfnt/ttmtx.c	2007-07-07 01:14:16.000000000 -0700
+++ freetype-2.3.5/src/sfnt/ttmtx.c	2007-07-07 01:14:35.000000000 -0700
@@ -174,7 +174,7 @@
     }
 
     if ( FT_QNEW_ARRAY( *longs,  num_longs  ) ||
-         FT_QNEW_ARRAY( *shorts, num_shorts ) )
+         (num_shorts > 0 && FT_QNEW_ARRAY( *shorts, num_shorts ) ) )
       goto Fail;
 
     if ( FT_FRAME_ENTER( table_len ) )