diff --git a/ChangeLog b/ChangeLog
index 9cf9416c2..c19dbe81e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2014-11-24  Werner Lemberg  <wl@gnu.org>
+
+	[type1, type42] Another fix for Savannah bug #43655.
+
+	* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
+	(t42_parse_charstrings): Add another boundary testing.
+
 2014-11-24  Werner Lemberg  <wl@gnu.org>
 
 	[docmaker] Formatting, copyright, improved documentation.
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index caa75bdd2..24b14a8bb 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1596,6 +1596,11 @@
       }
 
       T1_Skip_PS_Token( parser );
+      if ( parser->root.cursor >= limit )
+      {
+        error = FT_THROW( Invalid_File_Format );
+        goto Fail;
+      }
       if ( parser->root.error )
         return;
 
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c
index daf304d8a..d45c0699a 100644
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -849,6 +849,12 @@
         break;
 
       T1_Skip_PS_Token( parser );
+      if ( parser->root.cursor >= limit )
+      {
+        FT_ERROR(( "t42_parse_charstrings: out of bounds\n" ));
+        error = FT_THROW( Invalid_File_Format );
+        goto Fail;
+      }
       if ( parser->root.error )
         return;