* src/sfnt/ttsbit0.c (tt_sbit_decoder_init, tt_sbit_decoder_load_image): Protect against integer overflows. * src/pfr/pfrgload.c (pfr_glyph_load_simple): More bounding checks for `x_control' and `y_control'.