From 011d111218afae2f0abb06cf27b83e4740a51f85 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sun, 21 Jan 2007 09:36:00 +0000
Subject: [PATCH] * src/sfnt/ttmtx.c (tt_face_get_metrics)
 [!FT_CONFIG_OPTION_OLD_INTERNALS]: Fix limit check.

---
 ChangeLog        | 5 +++++
 src/sfnt/ttmtx.c | 4 ++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 7cb5f0b72..b2da9cd16 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2007-01-21  Werner Lemberg  <wl@gnu.org>
+
+	* src/sfnt/ttmtx.c (tt_face_get_metrics)
+	[!FT_CONFIG_OPTION_OLD_INTERNALS]: Fix limit check.
+
 2007-01-17  Werner Lemberg  <wl@gnu.org>
 
 
diff --git a/src/sfnt/ttmtx.c b/src/sfnt/ttmtx.c
index 46e93329a..63837b4f2 100644
--- a/src/sfnt/ttmtx.c
+++ b/src/sfnt/ttmtx.c
@@ -368,11 +368,11 @@
       if ( gindex < (FT_UInt)k )
       {
         table_pos += 4 * gindex;
-        if ( table_pos + 6 > table_end )
+        if ( table_pos + 4 > table_end )
           goto NoData;
 
         if ( FT_STREAM_SEEK( table_pos ) ||
-             FT_READ_USHORT( *aadvance)  ||
+             FT_READ_USHORT( *aadvance ) ||
              FT_READ_SHORT( *abearing )  )
           goto NoData;
       }