diff --git a/ChangeLog b/ChangeLog
index 976c1651b..d5436bed5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2015-02-20  Werner Lemberg  <wl@gnu.org>
+
+	[cff] Thinkos in bias handling.
+
+	Only the final result is always positive.
+
+	Bug introduced three commits earlier.
+
+	* src/cff/cffgload.c, src/cff/cffgload.h: Apply.
+
 2015-02-20  Werner Lemberg  <wl@gnu.org>
 
 	[cid] Fix signedness issues and emit some better error codes.
diff --git a/src/cff/cffgload.c b/src/cff/cffgload.c
index 0afa7454f..b20ad5070 100644
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -337,7 +337,7 @@
   /*                                                                       */
   /* <Return>                                                              */
   /*    The bias value.                                                    */
-  static FT_UInt
+  static FT_Int
   cff_compute_bias( FT_Int   in_charstring_type,
                     FT_UInt  num_subrs )
   {
@@ -2385,7 +2385,8 @@
 
         case cff_op_callsubr:
           {
-            FT_UInt  idx = ( (FT_UInt)args[0] >> 16 ) + decoder->locals_bias;
+            FT_UInt  idx = (FT_UInt)( ( args[0] >> 16 ) +
+                                      decoder->locals_bias );
 
 
             FT_TRACE4(( " callsubr(%d)\n", idx ));
@@ -2426,7 +2427,8 @@
 
         case cff_op_callgsubr:
           {
-            FT_UInt  idx = ( (FT_UInt)args[0] >> 16 ) + decoder->globals_bias;
+            FT_UInt  idx = (FT_UInt)( ( args[0] >> 16 ) +
+                                      decoder->globals_bias );
 
 
             FT_TRACE4(( " callgsubr(%d)\n", idx ));
diff --git a/src/cff/cffgload.h b/src/cff/cffgload.h
index 39c5f3246..5c52d430d 100644
--- a/src/cff/cffgload.h
+++ b/src/cff/cffgload.h
@@ -178,8 +178,8 @@ FT_BEGIN_HEADER
     FT_UInt            num_locals;
     FT_UInt            num_globals;
 
-    FT_UInt            locals_bias;
-    FT_UInt            globals_bias;
+    FT_Int             locals_bias;
+    FT_Int             globals_bias;
 
     FT_Byte**          locals;
     FT_Byte**          globals;