lib/support/unicodeconv/unicodeconv.c in libotfcc.a in otfcc v0.10.3-alpha has a buffer over-read.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20588.json"