kc3-lang/freetype

diff --git a/ChangeLog b/ChangeLog
index 7cb5f0b..b2da9cd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2007-01-21  Werner Lemberg  <wl@gnu.org>
+
+	* src/sfnt/ttmtx.c (tt_face_get_metrics)
+	[!FT_CONFIG_OPTION_OLD_INTERNALS]: Fix limit check.
+
 2007-01-17  Werner Lemberg  <wl@gnu.org>
 
 
diff --git a/src/sfnt/ttmtx.c b/src/sfnt/ttmtx.c
index 46e9332..63837b4 100644
--- a/src/sfnt/ttmtx.c
+++ b/src/sfnt/ttmtx.c
@@ -368,11 +368,11 @@
       if ( gindex < (FT_UInt)k )
       {
         table_pos += 4 * gindex;
-        if ( table_pos + 6 > table_end )
+        if ( table_pos + 4 > table_end )
           goto NoData;
 
         if ( FT_STREAM_SEEK( table_pos ) ||
-             FT_READ_USHORT( *aadvance)  ||
+             FT_READ_USHORT( *aadvance ) ||
              FT_READ_SHORT( *abearing )  )
           goto NoData;
       }