diff --git a/ChangeLog b/ChangeLog
index d054628ff..a873cfdc3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2018-06-12  Werner Lemberg  <wl@gnu.org>
+
+	[sfnt] Fix `sizeof' thinko.
+
+	* src/sfnt/ttcolr.c (tt_face_load_colr, tt_face_palette_set): Don't
+	use `sizeof' for computing array limit.
+
 2018-06-12  Werner Lemberg  <wl@gnu.org>
 
 	Finish CPAL/COLR support (4/4).
diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c
index 5efdc1038..fee484089 100644
--- a/src/sfnt/ttcolr.c
+++ b/src/sfnt/ttcolr.c
@@ -227,7 +227,7 @@
 
         p     = cpal_table + type_offset;
         q     = array;
-        limit = q + face->palette_data.num_palettes * sizeof ( FT_UShort );
+        limit = q + face->palette_data.num_palettes;
 
         while ( q < limit )
           *q++ = FT_NEXT_USHORT( p );
@@ -248,7 +248,7 @@
 
         p     = cpal_table + label_offset;
         q     = array;
-        limit = q + face->palette_data.num_palettes * sizeof ( FT_UShort );
+        limit = q + face->palette_data.num_palettes;
 
         while ( q < limit )
           *q++ = FT_NEXT_USHORT( p );
@@ -269,8 +269,7 @@
 
         p     = cpal_table + entry_label_offset;
         q     = array;
-        limit = q + face->palette_data.num_palette_entries *
-                    sizeof ( FT_UShort );
+        limit = q + face->palette_data.num_palette_entries;
 
         while ( q < limit )
           *q++ = FT_NEXT_USHORT( p );
@@ -459,7 +458,7 @@
     p      = cpal->colors + COLOR_SIZE * FT_PEEK_USHORT( offset );
 
     q     = face->palette;
-    limit = q + face->palette_data.num_palette_entries * sizeof ( FT_Color );
+    limit = q + face->palette_data.num_palette_entries;
 
     while ( q < limit )
     {