diff --git a/ChangeLog b/ChangeLog
index 8d4e31676..0c57dc774 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,20 @@
+2017-06-07  Werner Lemberg  <wl@gnu.org>
+
+	[cff, truetype] Integer overflows.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2133
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2137
+
+	* src/cff/cf2hints.c (cf2_hint_init): Use OVERFLOW_SUB_INT32.
+
+	* src/truetype/ttinterp.c (PROJECT, DUALPROJ): Use
+	OVERFLOW_SUB_LONG.
+
 2017-06-06  Werner Lemberg  <wl@gnu.org>
 
-	[cff] Integer overflow.
+	[cff] Integer overflows.
 
 	Reported as
 
diff --git a/src/cff/cf2hints.c b/src/cff/cf2hints.c
index e326c1b66..634b280bb 100644
--- a/src/cff/cf2hints.c
+++ b/src/cff/cf2hints.c
@@ -105,7 +105,7 @@
                                          stemHintArray,
                                          indexStemHint );
 
-    width = stemHint->max - stemHint->min;
+    width = OVERFLOW_SUB_INT32( stemHint->max, stemHint->min );
 
     if ( width == cf2_intToFixed( -21 ) )
     {
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index d39504a26..7ac9b38d8 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -65,11 +65,15 @@
             TT_INTERPRETER_VERSION_40 )
 #endif
 
-#define PROJECT( v1, v2 )                                                \
-          exc->func_project( exc, (v1)->x - (v2)->x, (v1)->y - (v2)->y )
+#define PROJECT( v1, v2 )                                            \
+          exc->func_project( exc,                                    \
+                             OVERFLOW_SUB_LONG( (v1)->x, (v2)->x ),  \
+                             OVERFLOW_SUB_LONG( (v1)->y, (v2)->y ) )
 
-#define DUALPROJ( v1, v2 )                                                \
-          exc->func_dualproj( exc, (v1)->x - (v2)->x, (v1)->y - (v2)->y )
+#define DUALPROJ( v1, v2 )                                            \
+          exc->func_dualproj( exc,                                    \
+                              OVERFLOW_SUB_LONG( (v1)->x, (v2)->x ),  \
+                              OVERFLOW_SUB_LONG( (v1)->y, (v2)->y ) )
 
 #define FAST_PROJECT( v )                          \
           exc->func_project( exc, (v)->x, (v)->y )