cb37f7c
--- fontforge-20120731-b/fontforge/parsepdf.c	2012-08-02 16:09:09.000000000 +0100
cb37f7c
+++ fontforge-20120731-b-new/fontforge/parsepdf.c	2013-02-07 17:44:05.371466086 +0000
cb37f7c
@@ -1691,9 +1691,9 @@
cb37f7c
     /* to "Unicode" values it specifies rather than to the real order in which the glyphs are */
cb37f7c
     /* stored in the file */
cb37f7c
     pos = cmap_from_cid || sf->map == NULL ? gid : sf->map->map[gid];
cb37f7c
-    sc = sf->glyphs[pos];
cb37f7c
     
cb37f7c
-    if (pos >= 0 && pos < sf->glyphcnt && (sc->unicodeenc != uvals[0] || nuni > 1)) {
cb37f7c
+    if (pos >= 0 && pos < sf->glyphcnt && (sf->glyphs[pos]->unicodeenc != uvals[0] || nuni > 1)) {
cb37f7c
+	sc = sf->glyphs[pos];
cb37f7c
 	/* Sometimes FF instead of assigning proper Unicode values to TTF glyphs keeps */
cb37f7c
 	/* them encoded to the same codepoint, but creates for each glyph an alternate */
cb37f7c
 	/* encoding, corresponding to the position this glyph has in the font's encoding */
cb37f7c
@@ -1723,6 +1723,7 @@
cb37f7c
     FILE *file;
cb37f7c
     int i, j, gid, start, end, uni, cur=0, nuni, nhex, nchars, lo, *uvals;
cb37f7c
     long *mappings;
cb37f7c
+    size_t num_mappings;
cb37f7c
     char tok[200], *ccval, prevtok[200];
cb37f7c
     SplineFont *sf = basesf->subfontcnt > 0 ? basesf->subfonts[0] : basesf;
cb37f7c
 
cb37f7c
@@ -1733,9 +1734,14 @@
cb37f7c
 return;
cb37f7c
     rewind(file);
cb37f7c
     
cb37f7c
+    num_mappings = sf->glyphcnt;
cb37f7c
     mappings = gcalloc(sf->glyphcnt,sizeof(long));
cb37f7c
     while ( pdf_getprotectedtok(file,tok) >= 0 ) {
cb37f7c
 	if ( strcmp(tok,"beginbfchar") == 0 && sscanf(prevtok,"%d",&nchars)) {
cb37f7c
+	    if (cur + nchars >= num_mappings) {
cb37f7c
+		num_mappings = cur + nchars;
cb37f7c
+		mappings = grealloc(mappings, num_mappings * sizeof(long));
cb37f7c
+	    }
cb37f7c
 	    for (i=0; i
cb37f7c
 		if (pdf_skip_brackets(file,tok) >= 0 && sscanf(tok,"%x",&gid) &&
cb37f7c
 		    pdf_skip_brackets(file,tok) >= 0 && sscanf(tok,"%lx",&mappings[cur])) {