#5 Array boundary exceeded

[Calvin]

There is an array boundary exceeded problem at fontinfo.c:417:
return fw_prod(fw, tfm_tbl[font].scale);

The value of font can be much bigger than the max value of array tfm_tbl. It will cause catdvi crash and can be triggered when the input is the attached file.