From f70d9342e65cd2cb44e9f26b6d7edeedf191fc6c Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Mon, 24 Nov 2014 09:31:32 +0100
Subject: [PATCH] [sfnt] Fix Savannah bug #43672.

* src/sfnt/ttkern.c (tt_face_load_kern): Use correct value for
minimum table length test.
---
 ChangeLog         | 7 +++++++
 src/sfnt/ttkern.c | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index c19dbe81e..432186ec6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2014-11-24  Werner Lemberg  <wl@gnu.org>
+
+	[sfnt] Fix Savannah bug #43672.
+
+	* src/sfnt/ttkern.c (tt_face_load_kern): Use correct value for
+	minimum table length test.
+
 2014-11-24  Werner Lemberg  <wl@gnu.org>
 
 	[type1, type42] Another fix for Savannah bug #43655.
diff --git a/src/sfnt/ttkern.c b/src/sfnt/ttkern.c
index 32c4008b2..455e7b5e3 100644
--- a/src/sfnt/ttkern.c
+++ b/src/sfnt/ttkern.c
@@ -99,7 +99,7 @@
       length   = FT_NEXT_USHORT( p );
       coverage = FT_NEXT_USHORT( p );
 
-      if ( length <= 6 )
+      if ( length <= 6 + 8 )
         break;
 
       p_next += length;