From caff7db93d205e32a535d49e51a3cad70f91dfdd Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Mon, 26 Apr 2010 10:07:35 -0400
Subject: [PATCH] Fix Device::get_size() calculation

---
 src/hb-ot-layout-common-private.hh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/hb-ot-layout-common-private.hh b/src/hb-ot-layout-common-private.hh
index 37d6782eb..c7c6e2b96 100644
--- a/src/hb-ot-layout-common-private.hh
+++ b/src/hb-ot-layout-common-private.hh
@@ -587,7 +587,7 @@ struct Device
   {
     unsigned int f = deltaFormat;
     if (HB_UNLIKELY (f < 1 || f > 3 || startSize > endSize)) return 3 * USHORT::get_size ();
-    return 3 * USHORT::get_size () + ((endSize - startSize + (1 << (4 - f)) - 1) >> (4 - f));
+    return USHORT::get_size () * (4 + ((endSize - startSize) >> (4 - f)));
   }
 
   inline bool sanitize (SANITIZE_ARG_DEF) {
@@ -598,7 +598,11 @@ struct Device
   private:
   USHORT	startSize;		/* Smallest size to correct--in ppem */
   USHORT	endSize;		/* Largest size to correct--in ppem */
-  USHORT	deltaFormat;		/* Format of DeltaValue array data: 1, 2, or 3 */
+  USHORT	deltaFormat;		/* Format of DeltaValue array data: 1, 2, or 3
+					 * 1	Signed 2-bit value, 8 values per uint16
+					 * 2	Signed 4-bit value, 4 values per uint16
+					 * 3	Signed 8-bit value, 2 values per uint16
+					 */
   USHORT	deltaValue[VAR];	/* Array of compressed data */
 };
 ASSERT_SIZE_VAR (Device, 6, USHORT);