; Fix a crash in sfnt_read_fvar_table

* src/sfnt.c (sfnt_read_fvar_table): Derive padding from correct
type.

diff --git a/src/sfnt.c b/src/sfnt.c
index b300eb4ba89a599a96671c678764985d4d222204..0666bb17cf0dd3cfc17aa071c2f9ea5f05abc593 100644 (file)
--- a/src/sfnt.c
+++ b/src/sfnt.c
@@ -14269,7 +14269,7 @@ sfnt_read_fvar_table (int fd, struct sfnt_offset_subtable *subtable)
       || INT_ADD_WRAPV (min_bytes, temp, &min_bytes))
     goto bail;
 
-  pad = alignof (struct sfnt_variation_axis);
+  pad = alignof (struct sfnt_instance);
   pad -= min_bytes & (pad - 1);
 
   if (INT_ADD_WRAPV (min_bytes, pad, &min_bytes))