kc3-lang/freetype

diff --git a/ChangeLog b/ChangeLog
index 977a4a6..1cc5c87 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,16 @@
 2012-01-17  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
 
+	[gxvalid] Fix Savannah bug #35286.
+
+	Patch submitted by anonymous reporter.
+
+	* src/gxvalid/gxvcommn.c (gxv_XStateTable_subtable_setup):
+	gxv_set_length_by_ulong_offset() must be called with 3, not 4,
+	the number of the subtables in the state tables; classTable,
+	stateArray, entryTable.
+
+2012-01-17  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
+
 	[raccess] Modify for PIC build.
 
 	Based on the patch provided by Erik Dahlstrom <ed@opera.com>,
diff --git a/src/gxvalid/gxvcommn.c b/src/gxvalid/gxvcommn.c
index d3c48d4..0fdfba2 100644
--- a/src/gxvalid/gxvcommn.c
+++ b/src/gxvalid/gxvcommn.c
@@ -1334,7 +1334,7 @@
     l[1] = stateArray_length_p;
     l[2] = entryTable_length_p;
 
-    gxv_set_length_by_ulong_offset( o, l, buff, 4, table_size, valid );
+    gxv_set_length_by_ulong_offset( o, l, buff, 3, table_size, valid );
   }