* src/sfnt/ttsbit0.c (tt_sbit_decoder_load_image): image_offset is added to image_start twice when image_format is 2 or 5.