diff --git a/ChangeLog b/ChangeLog
index ec324245b..4cbfd6ba6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2008-11-03  Werner Lemberg  <wl@gnu.org>
+
+	* src/type1/t1load.c (parse_subrs): Use an endless loop.  There are
+	fonts (like HELVI.PFB version 003.001, used on OS/2) which define
+	some `subrs' elements more than once.  Problem reported by Peter
+	Weilbacher <mozilla@weilbacher.org>.
+
 2008-10-15  Graham Asher  <graham.asher@btinternet.com>
 
 	* src/sfnt/ttpost.c (tt_post_default_names): Add `const'.
diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c
index f945b69c6..34a17ccf1 100644
--- a/src/psaux/psobjs.c
+++ b/src/psaux/psobjs.c
@@ -179,7 +179,7 @@
     if ( table->cursor + length > table->capacity )
     {
       FT_Error   error;
-      FT_Offset  new_size  = table->capacity;
+      FT_Offset  new_size = table->capacity;
       FT_Long    in_offset;
 
 
@@ -376,7 +376,7 @@
           /* skip octal escape or ignore backslash */
           for ( i = 0; i < 3 && cur < limit; ++i )
           {
-            if ( ! IS_OCTAL_DIGIT( *cur ) )
+            if ( !IS_OCTAL_DIGIT( *cur ) )
               break;
 
             ++cur;
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index 284b7d765..411a2aa19 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1330,9 +1330,9 @@
     PS_Table   table  = &loader->subrs;
     FT_Memory  memory = parser->root.memory;
     FT_Error   error;
-    FT_Int     n, num_subrs;
+    FT_Int     num_subrs;
 
-    PSAux_Service  psaux  = (PSAux_Service)face->psaux;
+    PSAux_Service  psaux = (PSAux_Service)face->psaux;
 
 
     T1_Skip_Spaces( parser );
@@ -1366,18 +1366,17 @@
         goto Fail;
     }
 
-    /* the format is simple:                                 */
-    /*                                                       */
-    /*   `index' + binary data                               */
-    /*                                                       */
-    for ( n = 0; n < num_subrs; n++ )
+    /* the format is simple:   */
+    /*                         */
+    /*   `index' + binary data */
+    /*                         */
+    for (;;)
     {
       FT_Long   idx, size;
       FT_Byte*  base;
 
 
-      /* If the next token isn't `dup', we are also done.  This */
-      /* happens when there are `holes' in the Subrs array.     */
+      /* If the next token isn't `dup' we are done. */
       if ( ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
         break;