; * src/sfnt.c (sfnt_read_avar_table): Fix sequencing problem.

diff --git a/src/sfnt.c b/src/sfnt.c
index 55739ced915198c22cdc7b2d1010a74e96a5a5fa..11b632ca555e4fbad053536860655870044fe5a3 100644 (file)
--- a/src/sfnt.c
+++ b/src/sfnt.c
@@ -13001,11 +13001,12 @@ sfnt_read_avar_table (int fd, struct sfnt_offset_subtable *subtable)
 
       /* Verify that words from here to buffer[1 + buffer[k] * 2], the
         next pairCount field, are within bounds.  */
-      if (k + 1 + buffer[k] * 2 > size / sizeof *buffer)
+      j = k + 1 + buffer[k] * 2;
+      if (j > size / sizeof *buffer)
        goto bail1;
 
       /* Move to the next pairCount field.  */
-      k += 1 + buffer[k] * 2;
+      k = j;
     }
 
   /* Resize avar to min_size and start filling in various