diff -urN fontconfig-2.3.92-org/src/fcfreetype.c fontconfig-2.3.92/src/fcfreetype.c
--- fontconfig-2.3.92-org/src/fcfreetype.c	2005-12-19 13:37:18.000000000 +0100
+++ fontconfig-2.3.92/src/fcfreetype.c	2005-12-19 14:30:06.973444735 +0100
@@ -56,9 +56,6 @@
 #include FT_SFNT_NAMES_H
 #include FT_TRUETYPE_IDS_H
 #include FT_TYPE1_TABLES_H
-#include FT_INTERNAL_STREAM_H
-#include FT_INTERNAL_SFNT_H
-#include FT_INTERNAL_TRUETYPE_TYPES_H
 #if HAVE_FT_GET_X11_FONT_FORMAT
 #include FT_XFREE86_H
 #endif
@@ -2733,87 +2730,104 @@
 static FT_Error
 GetScriptTags(FT_Face face, FT_ULong tabletag, FT_ULong **stags, FT_UShort *script_count)
 {
-    FT_ULong         cur_offset, new_offset, base_offset;
-    TT_Face          tt_face = (TT_Face)face;
-    FT_Stream  stream = face->stream;
+    FT_ULong   table_len, len;
+    FT_Long    offset, scripts_offset;
+    FT_UInt    count = 0;
+    FT_Byte    tt[6];
+    FT_ULong*  tags = NULL;
     FT_Error   error;
-    FT_UShort          n, p;
-    FT_Memory  memory = stream->memory;
 
-    if ( !stream )
-	return TT_Err_Invalid_Face_Handle;
-
-    if (( error = tt_face->goto_table( tt_face, tabletag, stream, 0 ) ))
-	return error;
-
-    base_offset = FT_STREAM_POS();
-
-    /* skip version */
-
-    if ( FT_STREAM_SEEK( base_offset + 4L ) || FT_FRAME_ENTER( 2L ) )
-	return error;
-
-    new_offset = FT_GET_USHORT() + base_offset;
-
-    FT_FRAME_EXIT();
-
-    cur_offset = FT_STREAM_POS();
-
-    if ( FT_STREAM_SEEK( new_offset ) != TT_Err_Ok )
-	return error;
-
-    base_offset = FT_STREAM_POS();
-
-    if ( FT_FRAME_ENTER( 2L ) )
-	return error;
-
-    *script_count = FT_GET_USHORT();
-
-    FT_FRAME_EXIT();
-
-    if ( FT_SET_ERROR (FT_MEM_ALLOC_ARRAY( *stags, *script_count, FT_ULong )) )
-	return error;
-
-    p = 0;
-    for ( n = 0; n < *script_count; n++ )
-    {
-	if ( FT_FRAME_ENTER( 6L ) )
-	    goto Fail;
-
-	(*stags)[p] = FT_GET_ULONG();
-	new_offset = FT_GET_USHORT() + base_offset;
+    /* get table length */
+    table_len = 0;
+    error = FT_Load_Sfnt_Table( face, tabletag, 0, NULL, &table_len );
+    if ( error ) goto Exit;
+
+    if ( table_len < 6 )
+        goto BadTable;
+    
+    /* get offset to script list */
+    len   = 2;
+    error = FT_Load_Sfnt_Table( face, tabletag, 4, tt, &len );
+    if ( error ) goto Exit;
+
+    scripts_offset = (FT_ULong)( (tt[0] << 8) | tt[1] );
+    if ( scripts_offset+2 > table_len )
+        goto BadTable;
+      
+    /* get number of scripts in list */
+    len    = 2;
+    error  = FT_Load_Sfnt_Table( face, tabletag, scripts_offset, tt, &len );
+    if ( error ) goto Exit;
+
+    count = (FT_UInt)( (tt[0] << 8) | tt[1] );
+
+    if ( (FT_ULong)count > (table_len - scripts_offset - 2)/6 )
+      goto BadTable;
+
+    if ( count > 0 )
+    {
+        FT_UInt  nn, mm;
+
+        tags = malloc( sizeof(FT_ULong)*count );
+        if ( tags == NULL )
+        {
+            error = FT_Err_Out_Of_Memory;
+            count = 0;
+            goto Exit;
+        }
 
-	FT_FRAME_EXIT();
+        /* now read each script tag */
+        len    = 6;
+        mm     = 0;
+        offset = scripts_offset + 2;
+        for ( nn = 0; nn < count; nn++, offset += 6 )
+        {
+            FT_ULong  the_tag;
+            FT_UInt   the_offset;
+
+            len   = 6;
+            error = FT_Load_Sfnt_Table( face, tabletag, offset, tt, &len );
+            if ( error ) goto Fail;
+
+            the_tag = ((FT_ULong)tt[0] << 24) |
+                      ((FT_ULong)tt[1] << 16) |
+                      ((FT_ULong)tt[2] <<  8) |
+                       (FT_ULong)tt[3]        ;
+
+            the_offset = (FT_UInt)( (tt[4] << 8) | tt[5] );
+
+            if ( the_offset != 0                                   &&
+                 (FT_ULong)the_offset < table_len - scripts_offset )
+            {
+                /* only record tags with a valid offset */
+                tags[mm++] = the_tag;
+            }
+        }
 
-	cur_offset = FT_STREAM_POS();
+        count = mm;
+    }
 
-	if ( FT_STREAM_SEEK( new_offset ) )
-	    goto Fail;
+    /* sort the tag list before returning it */
+    qsort( tags, count, sizeof(FT_ULong), compareulong);
 
-	if ( error == TT_Err_Ok )
-	    p++;
-	else if ( error != TTO_Err_Empty_Script )
-	    goto Fail;
+  Exit:    
+    *script_count = (FT_UShort)count;
+    *stags        = tags;
 
-	(void)FT_STREAM_SEEK( cur_offset );
-    }
+    return error;
 
-    if (!p)
+  BadTable:
+    error = FT_Err_Invalid_Table;
+    
+  Fail:
+    if ( tags )
     {
-	error = TTO_Err_Invalid_SubTable;
-	goto Fail;
+        free( tags );
+        tags  = NULL;
     }
-
-    // sort the tag list before returning it
-    qsort(*stags, *script_count, sizeof(FT_ULong), compareulong);
-
-    return TT_Err_Ok;
-
-Fail:
-    *script_count = 0;
-    FT_FREE( *stags );
-    return error;
-}
+    count = 0;
+    goto Exit;
+}    
 
 static FcChar8 *
 FcFontCapabilities(FT_Face face)
@@ -2824,7 +2838,6 @@
     FT_ULong *gsubtags=NULL, *gpostags=NULL;
     FT_UShort gsub_count=0, gpos_count=0;
     FT_ULong maxsize;
-    FT_Memory  memory = face->stream->memory;
     FcChar8 *complex = NULL;
     int indx1 = 0, indx2 = 0;
 
@@ -2868,7 +2881,9 @@
     if (FcDebug () & FC_DBG_SCANV)
 	printf("complex features in this font: %s\n", complex);
 bail:
-    FT_FREE(gsubtags);
-    FT_FREE(gpostags);
+    if ( gsubtags )
+        free( gsubtags );
+    if ( gpostags )
+        free( gpostags );
     return complex;
 }