diff --git a/src/hb-uniscribe.cc b/src/hb-uniscribe.cc index fcb1aa65d..905ad5ea1 100644 --- a/src/hb-uniscribe.cc +++ b/src/hb-uniscribe.cc @@ -776,13 +776,14 @@ retry: } } - /* All the following types are sized in multiples of sizeof(int). */ - unsigned int glyphs_size = scratch_size / ((sizeof (WORD) + - sizeof (SCRIPT_GLYPHPROP) + - sizeof (int) + - sizeof (GOFFSET) + - sizeof (uint32_t)) - / sizeof (int)); + /* The -2 in the following is to compensate for possible + * alignment needed after the WORD array. sizeof(WORD) == 2. */ + unsigned int glyphs_size = (scratch_size * sizeof (int) - 2) + / (sizeof (WORD) + + sizeof (SCRIPT_GLYPHPROP) + + sizeof (int) + + sizeof (GOFFSET) + + sizeof (uint32_t)); ALLOCATE_ARRAY (WORD, glyphs, glyphs_size); ALLOCATE_ARRAY (SCRIPT_GLYPHPROP, glyph_props, glyphs_size);