From 2e01c712137b402882edaaab28692a1e38f7667d Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Tue, 13 May 2014 14:42:44 +0200
Subject: [PATCH] Fix computation of last element in `loca' table.

Problem reported by Girish Dalvi <girish.dalvi@gmail.com>.
---
 THANKS       | 3 +++
 lib/taloca.c | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/THANKS b/THANKS
index e3733fe..39e6915 100644
--- a/THANKS
+++ b/THANKS
@@ -20,8 +20,11 @@ library and front-ends:
 Dave Arnold <darnold@adobe.com>
 Vernon Adams <vern@newtypography.co.uk>
 Frederik Berlaen <frederik@typemytype.com>
+Frank E. Blokland <blokland@dutchtypelibrary.com>
 James Cloos <cloos@jhcloos.com>
+Girish Dalvi <girish.dalvi@gmail.com>
 Erwin Denissen <erwin.denissen@high-logic.com>
+Ralf S. Engelschall <rse@engelschall.com>
 Greg Hitchcock <gregh@microsoft.com>
 Hirwen Harendal <harendalh@gmail.com>
 Khaled Hosny <khaledhosny@eglug.org>
diff --git a/lib/taloca.c b/lib/taloca.c
index 5d1e407..e02fea7 100644
--- a/lib/taloca.c
+++ b/lib/taloca.c
@@ -51,6 +51,10 @@ TA_sfnt_build_loca_table(SFNT* sfnt,
       offset += 2;
   }
 
+  /* to make the short format of the `loca' table always work, */
+  /* the `glyf' table's length is adjusted to an even value */
+  offset = (offset + 1) & ~1;
+
   if (offset > 0xFFFF * 2)
     loca_format = 1;
   else
@@ -85,6 +89,7 @@ TA_sfnt_build_loca_table(SFNT* sfnt,
     }
 
     /* last element holds the size of the `glyf' table */
+    offset = (offset + 1) & ~1;
     *(p++) = BYTE1(offset);
     *(p++) = BYTE2(offset);
     *(p++) = BYTE3(offset);
@@ -117,6 +122,7 @@ TA_sfnt_build_loca_table(SFNT* sfnt,
     }
 
     /* last element holds the size of the `glyf' table */
+    offset = (offset + 1) & ~1;
     *(p++) = HIGH(offset);
     *(p++) = LOW(offset);
 
-- 
2.11.4.GIT