From b10f8a8225791f127ce3fedef907f68f7bf6b983 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sun, 5 Jun 2011 06:28:27 +0200
Subject: [PATCH] Fix reallocation of bytecode buffer.

---
 src/tabytecode.c | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/src/tabytecode.c b/src/tabytecode.c
index 515cab2..972d663 100644
--- a/src/tabytecode.c
+++ b/src/tabytecode.c
@@ -2542,8 +2542,8 @@ TA_sfnt_build_glyph_instructions(SFNT* sfnt,
 
   if (num_hints_records == 1 && !hints_records[0].num_actions)
   {
-    /* clear `ins_buf' if we only have a single empty record */
-    memset(ins_buf, INS_A0, (bufp + 2) - ins_buf);
+    /* don't emit anything if we only have a single empty record */
+    ins_len = 0;
   }
   else
   {
@@ -2553,17 +2553,28 @@ TA_sfnt_build_glyph_instructions(SFNT* sfnt,
     /* otherwise, clear the temporarily used part of `ins_buf' */
     while (*p != INS_A0)
       *(p++) = INS_A0;
+
     bufp = TA_sfnt_emit_hints_records(sfnt,
                                       hints_records, num_hints_records,
                                       bufp);
-  }
 
-  /* we are done, so reallocate the instruction array to its real size */
-  /* (memrchr is a GNU glibc extension, so we do it manually) */
-  bufp = ins_buf + ins_len;
-  while (*(--bufp) == INS_A0)
-    ;
-  ins_len = bufp - ins_buf + 1;
+    /* we are done, so reallocate the instruction array to its real size */
+    if (*bufp == INS_A0)
+    {
+      /* search backwards */
+      while (*bufp == INS_A0)
+        bufp--;
+      bufp++;
+    }
+    else
+    {
+      /* search forwards */
+      while (*bufp != INS_A0)
+        bufp++;
+    }
+
+    ins_len = bufp - ins_buf;
+  }
 
   if (ins_len > sfnt->max_instructions)
     sfnt->max_instructions = ins_len;
-- 
2.11.4.GIT