FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c. https://nvd.nist.gov/vuln/detail/CVE-2017-8287
