[uniscribe] Fix scratch-buffer accounting
diff --git a/src/hb-uniscribe.cc b/src/hb-uniscribe.cc
index fcb1aa6..905ad5e 100644
--- a/src/hb-uniscribe.cc
+++ b/src/hb-uniscribe.cc
@@ -776,13 +776,14 @@
}
}
- /* All the following types are sized in multiples of sizeof(int). */
- unsigned int glyphs_size = scratch_size / ((sizeof (WORD) +
- sizeof (SCRIPT_GLYPHPROP) +
- sizeof (int) +
- sizeof (GOFFSET) +
- sizeof (uint32_t))
- / sizeof (int));
+ /* The -2 in the following is to compensate for possible
+ * alignment needed after the WORD array. sizeof(WORD) == 2. */
+ unsigned int glyphs_size = (scratch_size * sizeof (int) - 2)
+ / (sizeof (WORD) +
+ sizeof (SCRIPT_GLYPHPROP) +
+ sizeof (int) +
+ sizeof (GOFFSET) +
+ sizeof (uint32_t));
ALLOCATE_ARRAY (WORD, glyphs, glyphs_size);
ALLOCATE_ARRAY (SCRIPT_GLYPHPROP, glyph_props, glyphs_size);
