diff --git a/src/hb-subset-cff-common.hh b/src/hb-subset-cff-common.hh
index 0f8bc15cc..4d5dadbdf 100644
--- a/src/hb-subset-cff-common.hh
+++ b/src/hb-subset-cff-common.hh
@@ -981,7 +981,7 @@ struct subr_subsetter_t
       if (opstr.op == OpCode_callsubr || opstr.op == OpCode_callgsubr)
         size += 3;
     }
-    if (!buff.alloc (size))
+    if (!buff.alloc (buff.length + size))
       return false;
 
     for (auto &opstr : str.values)