When ff calculated the size of a kerning subtable it was off by two bytes per glyph in the coverage table. This meant that it would sometimes make a table that was slightly too big to be supported and not realize it. I've fixed the bug, and put in checks so that if there's yet another problem like this, at list it will be reported to the user.

3 files changed, 12 insertions, 5 deletions

diff --git a/fontforge/stamp.c b/fontforge/stamp.c
index 919a2208..4b0203b5 100644
--- a/fontforge/stamp.c
+++ b/fontforge/stamp.c
@@ -1,5 +1,5 @@
 #include <time.h>
 
-const time_t source_modtime = 1297116424L;
-const char *source_modtime_str = "22:07 GMT 7-Feb-2011";
-const char *source_version_str = "20110207";
+const time_t source_modtime = 1297295727L;
+const char *source_modtime_str = "23:55 GMT 9-Feb-2011";
+const char *source_version_str = "20110209";
diff --git a/fontforge/tottf.c b/fontforge/tottf.c
index 832bb971..dd1f754d 100644
--- a/fontforge/tottf.c
+++ b/fontforge/tottf.c
@@ -506,6 +506,8 @@ return( (ch1<<24)|(ch2<<16)|(ch3<<8)|ch4 );
 }
 
 void putshort(FILE *file,int sval) {
+    if ( sval<-32768 || sval>65535 )
+	IError(_("Attempt to output %d into a 16-bit field. It will be truncated and the file may not be useful."), sval );
     putc((sval>>8)&0xff,file);
     putc(sval&0xff,file);
 }
diff --git a/fontforge/tottfgpos.c b/fontforge/tottfgpos.c
index 3bcbbe34..6857254b 100644
--- a/fontforge/tottfgpos.c
+++ b/fontforge/tottfgpos.c
@@ -973,6 +973,7 @@ static void dumpGPOSpairpos(FILE *gpos,SplineFont *sf,struct lookup_subtable *su
 			devtablen += ValDevTabLen(pst->u.pair.vr[0].adjust) +
 				 ValDevTabLen(pst->u.pair.vr[1].adjust);
 #endif
+
 		    }
 		    ++tot;
 		}
@@ -1121,12 +1122,13 @@ static void dumpGPOSpairpos(FILE *gpos,SplineFont *sf,struct lookup_subtable *su
 
     chunk_max = chunk_cnt = 0;
     for ( start_cnt=0; start_cnt<cnt; start_cnt=end_cnt ) {
-	int len = 5*2;
+	int len = 5*2;		/* Subtable header */
 	for ( end_cnt=start_cnt; end_cnt<cnt; ++end_cnt ) {
 	    int glyph_len = 2;		/* For the glyph's offset */
 	    if ( seconds[end_cnt][0].samewas==0xffff || seconds[end_cnt][0].samewas<start_cnt )
 		glyph_len += (bit_cnt*2+2)*seconds[end_cnt][0].tot +
-				seconds[end_cnt][0].devtablen;
+				seconds[end_cnt][0].devtablen +
+			        2;	/* Number of secondary glyphs */
 	    if ( glyph_len>65535 && end_cnt==start_cnt ) {
 		LogError(_("Lookup subtable %s contains a glyph %s whose kerning information takes up more than 64k bytes\n"),
 			sub->subtable_name, glyphs[start_cnt]->name );
@@ -1239,6 +1241,8 @@ static void dumpGPOSpairpos(FILE *gpos,SplineFont *sf,struct lookup_subtable *su
 	}
 	end = ftell(gpos);
 	fseek(gpos,coverage_pos,SEEK_SET);
+	if ( end-start>65535 )
+	    IError(_("I miscalculated the size of subtable %s, this means the kerning output is wrong."), sub->subtable_name );
 	putshort(gpos,end-start);
 	fseek(gpos,end,SEEK_SET);
 	gtemp = glyphs[end_cnt]; glyphs[end_cnt] = NULL;
@@ -3249,6 +3253,7 @@ return( NULL );
 	    free(sub->extra_subtables);
 	    sub->extra_subtables = NULL;
 	}
+	otf->needs_extension = false;
     }
 return( g___ );
 }