Code:  static int is_integer(char *string)
 {
  if (isdigit(string[0]) || string[0] == '-' || string[0] == '+') {
    while (*++string && isdigit(*string))
       ;                                           /* deliberately empty */
     if (!*string)
       return 1;
  }
  return 0;
}

Vulnerability Type: DoS Exec Code Overflow 
CWE ID: CWE-119
Summary: Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Commit Message: Security fixes.

- Don't overflow the small cs_start buffer (reported by Niels
  Thykier via the debian tracker (Jakub Wilk), found with a
  fuzzer ("American fuzzy lop")).

- Cast arguments to <ctype.h> functions to unsigned char.