diff --git a/ChangeLog b/ChangeLog
index e7e92c18d..24735469d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2016-03-29  Werner Lemberg  <wl@gnu.org>
+
+	[pfr] Fix binary search (#47514).
+
+	* src/pfr/pfrsbit.c (pfr_lookup_bitmap_data): Handle border
+	conditions correctly.
+
 2016-03-29  Werner Lemberg  <wl@gnu.org>
 
 	[pfr] Minor.
diff --git a/src/pfr/pfrsbit.c b/src/pfr/pfrsbit.c
index abdbb2084..68da033d4 100644
--- a/src/pfr/pfrsbit.c
+++ b/src/pfr/pfrsbit.c
@@ -364,13 +364,12 @@
       else
         code = PFR_NEXT_BYTE( buff );
 
-      if ( code == char_code )
-        goto Found_It;
-
-      if ( code < char_code )
-        min = mid;
-      else
+      if ( char_code < code )
         max = mid;
+      else if ( char_code > code )
+        min = mid + 1;
+      else
+        goto Found_It;
     }
 
   Fail:
diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c
index 8f9e3c1f5..01255a887 100644
--- a/src/sfnt/ttcmap.c
+++ b/src/sfnt/ttcmap.c
@@ -3104,7 +3104,7 @@
 
       if ( char_code < start )
         max = mid;
-      else if ( char_code > start+cnt )
+      else if ( char_code > start + cnt )
         min = mid + 1;
       else
         return TRUE;