diff --git a/ChangeLog b/ChangeLog
index 2fbf45460..0a03d739a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2013-06-25  Werner Lemberg  <wl@gnu.org>
+
+	[cff] Add darkening limit to `darkening-parameters'.
+
+	* src/cff/cffdrivr.c (cff_property_set): Add check.
+
 2013-06-25  Werner Lemberg  <wl@gnu.org>
 
 	[cff] Add `darkening-parameters' property.
diff --git a/include/freetype/ftcffdrv.h b/include/freetype/ftcffdrv.h
index 6235d85f9..f2b1016f4 100644
--- a/include/freetype/ftcffdrv.h
+++ b/include/freetype/ftcffdrv.h
@@ -173,8 +173,10 @@ FT_BEGIN_HEADER
    *   }
    *
    *   The x~values give the stem width, and the y~values the darkening
-   *   amount.  All coordinate values must be positive and monotonically
-   *   increasing along the x~axis; the unit is 1000th of pixels.
+   *   amount.  The unit is 1000th of pixels.  All coordinate values must be
+   *   positive; the x~values must be monotonically increasing, and the
+   *   y~values smaller than or equal to 500 (corresponding to half a
+   *   pixel).
    *
    * @note:
    *   This property can be used with @FT_Property_Get also.
diff --git a/src/cff/cffdrivr.c b/src/cff/cffdrivr.c
index 4652f59ad..51fc73508 100644
--- a/src/cff/cffdrivr.c
+++ b/src/cff/cffdrivr.c
@@ -600,9 +600,10 @@
       FT_Int  y4 = darken_params[7];
 
 
-      if ( x1 < 0 || x2 < 0 || x3 < 0 || x4 < 0 ||
-           y1 < 0 || y2 < 0 || y3 < 0 || y4 < 0 ||
-           x1 > x2 || x2 > x3 || x3 > x4        )
+      if ( x1 < 0   || x2 < 0   || x3 < 0   || x4 < 0   ||
+           y1 < 0   || y2 < 0   || y3 < 0   || y4 < 0   ||
+           x1 > x2  || x2 > x3  || x3 > x4              ||
+           y1 > 500 || y2 > 500 || y3 > 500 || y4 > 500 )
         return FT_THROW( Invalid_Argument );
 
       driver->darken_params[0] = x1;