* src/sfnt/ttmtx.c (tt_face_get_metrics) [!FT_CONFIG_OPTION_OLD_INTERNALS]: Fix limit check.
diff --git a/ChangeLog b/ChangeLog
index 7cb5f0b..b2da9cd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2007-01-21 Werner Lemberg <wl@gnu.org>
+
+ * src/sfnt/ttmtx.c (tt_face_get_metrics)
+ [!FT_CONFIG_OPTION_OLD_INTERNALS]: Fix limit check.
+
2007-01-17 Werner Lemberg <wl@gnu.org>
diff --git a/src/sfnt/ttmtx.c b/src/sfnt/ttmtx.c
index 46e9332..63837b4 100644
--- a/src/sfnt/ttmtx.c
+++ b/src/sfnt/ttmtx.c
@@ -368,11 +368,11 @@
if ( gindex < (FT_UInt)k )
{
table_pos += 4 * gindex;
- if ( table_pos + 6 > table_end )
+ if ( table_pos + 4 > table_end )
goto NoData;
if ( FT_STREAM_SEEK( table_pos ) ||
- FT_READ_USHORT( *aadvance) ||
+ FT_READ_USHORT( *aadvance ) ||
FT_READ_SHORT( *abearing ) )
goto NoData;
}