From d90567b1e6f5d50c259dc554ff294f4588a617ad Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sun, 18 Oct 2009 10:47:11 +0200
Subject: [PATCH] Fix handling of `dup' CFF instruction. Problem and solution
 reported by Ning Dong <flintning@163.com>.

* src/cff/cffgload.c (cff_decoder_parse_charstrings) <cff_op_dup>:
Increase `args' by 2, not 1.
---
 ChangeLog          | 8 ++++++++
 src/cff/cffgload.c | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 040789053..53141f2a0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2009-10-18  Werner Lemberg  <wl@gnu.org>
+
+	Fix handling of `dup' CFF instruction.
+	Problem and solution reported by Ning Dong <flintning@163.com>.
+
+	* src/cff/cffgload.c (cff_decoder_parse_charstrings) <cff_op_dup>:
+	Increase `args' by 2, not 1.
+
 2009-10-10  Werner Lemberg  <wl@gnu.org>
 
 	* Version 2.3.11 released.
diff --git a/src/cff/cffgload.c b/src/cff/cffgload.c
index 40fa20b42..d83c40646 100644
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -2106,7 +2106,7 @@
           FT_TRACE4(( " dup\n" ));
 
           args[1] = args[0];
-          args++;
+          args += 2;
           break;
 
         case cff_op_put: