diff --git a/src/hb-aat-layout-common-private.hh b/src/hb-aat-layout-common-private.hh
index e0f59a4ad..fea3b0949 100644
--- a/src/hb-aat-layout-common-private.hh
+++ b/src/hb-aat-layout-common-private.hh
@@ -563,9 +563,9 @@ struct StateTable
     unsigned int entry = 0;
     while (state < num_states)
     {
-      if (unlikely (!c->check_array (states + state * nClasses,
-				     states[0].static_size,
-				     nClasses * (num_states - state))))
+      if (unlikely (!c->check_array (states,
+				     states[0].static_size * nClasses,
+				     num_states)))
 	return_trace (false);
       { /* Sweep new states. */
 	const HBUINT16 *stop = &states[num_states * nClasses];
@@ -574,9 +574,9 @@ struct StateTable
 	state = num_states;
       }
 
-      if (unlikely (!c->check_array (entries + entry,
+      if (unlikely (!c->check_array (entries,
 				     entries[0].static_size,
-				     num_entries - entry)))
+				     num_entries)))
 	return_trace (false);
       { /* Sweep new entries. */
 	const Entry<Extra> *stop = &entries[num_entries];
diff --git a/src/hb-aat-layout-morx-table.hh b/src/hb-aat-layout-morx-table.hh
index f8209a600..fc834ebf2 100644
--- a/src/hb-aat-layout-morx-table.hh
+++ b/src/hb-aat-layout-morx-table.hh
@@ -281,7 +281,7 @@ struct ContextualSubtable
     TRACE_SANITIZE (this);
 
     unsigned int num_entries = 0;
-    if (unlikely (!machine.sanitize (c, &num_entries))) return false;
+    if (unlikely (!machine.sanitize (c, &num_entries))) return_trace (false);
 
     unsigned int num_lookups = 0;
 
@@ -454,9 +454,8 @@ struct LigatureSubtable
   {
     TRACE_SANITIZE (this);
     /* The rest of array sanitizations are done at run-time. */
-    return c->check_struct (this) && machine.sanitize (c) &&
-	   ligAction && component && ligature;
-    return_trace (true);
+    return_trace (c->check_struct (this) && machine.sanitize (c) &&
+		  ligAction && component && ligature);
   }
 
   protected: