src/java.desktop/share/native/libfreetype/src/sfnt/ttmtx.c

@@ -278,11 +278,11 @@
           goto NoData;
       }
       else
       {
         table_pos += 4 * ( k - 1 );
-        if ( table_pos + 4 > table_end )
+        if ( table_pos + 2 > table_end )
           goto NoData;
 
         if ( FT_STREAM_SEEK( table_pos ) ||
              FT_READ_USHORT( *aadvance ) )
           goto NoData;

@@ -290,11 +290,13 @@
         table_pos += 4 + 2 * ( gindex - k );
         if ( table_pos + 2 > table_end )
           *abearing = 0;
         else
         {
-          if ( !FT_STREAM_SEEK( table_pos ) )
+          if ( FT_STREAM_SEEK( table_pos ) )
+            *abearing = 0;
+          else
             (void)FT_READ_SHORT( *abearing );
         }
       }
     }
     else