diff --git a/ghostscript-glyph-crash.patch b/ghostscript-glyph-crash.patch
new file mode 100644
index 0000000..43af73f
--- /dev/null
+++ b/ghostscript-glyph-crash.patch
@@ -0,0 +1,61 @@
+diff -up ghostscript-9.04/psi/zfapi.c.glyph-crash ghostscript-9.04/psi/zfapi.c
+--- ghostscript-9.04/psi/zfapi.c.glyph-crash	2011-08-05 12:12:20.000000000 +0100
++++ ghostscript-9.04/psi/zfapi.c	2011-11-01 13:24:54.334696191 +0000
+@@ -1885,34 +1885,35 @@ static int fapi_finish_render_aux(i_ctx_
+             /* The server provides an outline instead the raster. */
+             gs_imager_state *pis = (gs_imager_state *)pgs->show_gstate;
+             gs_point pt;
++            if (!I->skip_glyph) {
++                if ((code = gs_currentpoint(pgs, &pt)) < 0)
++                    return code;
++                if ((code = outline_char(i_ctx_p, I, import_shift_v, penum_s, pgs->path, !pbfont->PaintType)) < 0)
++                    return code;
++                if ((code = gs_imager_setflat((gs_imager_state *)pgs, gs_char_flatness(pis, 1.0))) < 0)
++                    return code;
++                if (pbfont->PaintType) {
++                    float lw = gs_currentlinewidth(pgs);
+ 
+-            if ((code = gs_currentpoint(pgs, &pt)) < 0)
+-                return code;
+-            if ((code = outline_char(i_ctx_p, I, import_shift_v, penum_s, pgs->path, !pbfont->PaintType)) < 0)
+-                return code;
+-            if ((code = gs_imager_setflat((gs_imager_state *)pgs, gs_char_flatness(pis, 1.0))) < 0)
+-                return code;
+-            if (pbfont->PaintType) {
+-                float lw = gs_currentlinewidth(pgs);
++                    gs_setlinewidth(pgs, pbfont->StrokeWidth);
++                    code = gs_stroke(pgs);
++                    gs_setlinewidth(pgs, lw);
++                    if (code < 0)
++                        return code;
++                } else {
++                    gs_in_cache_device_t in_cachedevice = pgs->in_cachedevice;
++                    pgs->in_cachedevice = CACHE_DEVICE_NOT_CACHING;
+ 
+-                gs_setlinewidth(pgs, pbfont->StrokeWidth);
+-                code = gs_stroke(pgs);
+-                gs_setlinewidth(pgs, lw);
+-                if (code < 0)
+-                    return code;
+-            } else {
+-                gs_in_cache_device_t in_cachedevice = pgs->in_cachedevice;
+-                pgs->in_cachedevice = CACHE_DEVICE_NOT_CACHING;
++                    pgs->fill_adjust.x = pgs->fill_adjust.y = 0;
+ 
+-                pgs->fill_adjust.x = pgs->fill_adjust.y = 0;
++                    if ((code = gs_fill(pgs)) < 0)
++                        return code;
+ 
+-                if ((code = gs_fill(pgs)) < 0)
++                    pgs->in_cachedevice = in_cachedevice;
++                }
++                if ((code = gs_moveto(pgs, pt.x, pt.y)) < 0)
+                     return code;
+-
+-                pgs->in_cachedevice = in_cachedevice;
+             }
+-            if ((code = gs_moveto(pgs, pt.x, pt.y)) < 0)
+-                return code;
+         } else {
+             int rast_orig_x =   rast.orig_x;
+             int rast_orig_y = - rast.orig_y;
diff --git a/ghostscript.spec b/ghostscript.spec
index 53df5a5..0027a1d 100644
--- a/ghostscript.spec
+++ b/ghostscript.spec
@@ -5,7 +5,7 @@ Summary: A PostScript interpreter and renderer
 Name: ghostscript
 Version: %{gs_ver}
 
-Release: 4%{?dist}
+Release: 5%{?dist}
 
 # Included CMap data is Redistributable, no modification permitted,
 # see http://bugzilla.redhat.com/487510
@@ -22,6 +22,7 @@ Patch3: ghostscript-noopt.patch
 Patch4: ghostscript-ijs-automake-ver.patch
 Patch5: ghostscript-runlibfileifexists.patch
 Patch6: ghostscript-cups-rgbw.patch
+Patch7: ghostscript-glyph-crash.patch
 Patch8: ghostscript-jbig2dec-nullderef.patch
 Patch10: ghostscript-cups-filters.patch
 Patch27: ghostscript-Fontmap.local.patch
@@ -125,6 +126,9 @@ rm -rf libpng zlib jpeg jasper expat
 # bug #691922).
 %patch6 -p1 -b .cups-rgbw
 
+# Applied upstream fix for skipping "cached" outline glyphs (bug #742349).
+%patch7 -p1 -b .glyph-crash
+
 # Applied patch to fix NULL dereference in JBIG2 decoder (bug #501710).
 %patch8 -p1 -b .jbig2dec-nullderef
 
@@ -335,6 +339,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/libgs.so
 
 %changelog
+* Tue Nov  1 2011 Tim Waugh <twaugh@redhat.com> 9.04-5
+- Applied upstream fix for skipping "cached" outline glyphs (bug #742349).
+
 * Wed Aug 31 2011 Tim Waugh <twaugh@redhat.com> 9.04-4
 - Fixed typo (EXTRAFLAGS -> EXTRACFLAGS).