diff -c -r gnome-print-0.35/libgnomeprint/gp-truetype-utils.c gnome-print-0.35_new/libgnomeprint/gp-truetype-utils.c
*** gnome-print-0.35/libgnomeprint/gp-truetype-utils.c	Mon Nov  5 09:07:29 2001
--- gnome-print-0.35_new/libgnomeprint/gp-truetype-utils.c	Sun Apr 28 21:49:57 2002
***************
*** 103,114 ****
  		next = tables ? GPOINTER_TO_UINT (tables->data) : len;
  		size = next - start;
  		/* start new string, if we do not fit into limit */
! 		if ((stringsize + size) > GPTT_STRING_MAX) {
  			slices = g_slist_prepend (slices, GUINT_TO_POINTER (start));
  			stringsize = 0;
  		}
  		/* Test, whether current table fits at all */
! 		if (size > GPTT_STRING_MAX) {
  			if (start == glyf) {
  				slices = gp_tt_split_glyf (buf, start, next, loca, head, maxp, slices);
  				if (!slices) {
--- 103,114 ----
  		next = tables ? GPOINTER_TO_UINT (tables->data) : len;
  		size = next - start;
  		/* start new string, if we do not fit into limit */
! 		if ((stringsize + size) >= GPTT_STRING_MAX) {
  			slices = g_slist_prepend (slices, GUINT_TO_POINTER (start));
  			stringsize = 0;
  		}
  		/* Test, whether current table fits at all */
! 		if (size >= GPTT_STRING_MAX) {
  			if (start == glyf) {
  				slices = gp_tt_split_glyf (buf, start, next, loca, head, maxp, slices);
  				if (!slices) {
***************
*** 141,188 ****
  	guint16 numGlyphs;
  	guint32 start;
  	guint32 offset;
  	gint i;
  
  	indexToLocFormat = GUINT16FROMPTR (buf + head + 52);
  	numGlyphs = GUINT16FROMPTR (buf + maxp + 4);
  
  	start = glyf;
  
  	switch (indexToLocFormat) {
  	case 0:
  		/* Short offsets */
  		for (i = 0; i < numGlyphs; i++) {
  			offset = glyf + GUINT16FROMPTR (buf + loca + 2 * i + 2) * 2;
! 			if ((offset - start) > GPTT_STRING_MAX) {
! 				/* Write down current offset */
! 				offset = glyf + GUINT16FROMPTR (buf + loca + 2 * i) * 2;
! 				slices = g_slist_prepend (slices, GUINT_TO_POINTER (offset));
! 				start = offset;
! 			}
! 		}
! 		if ((next - start) > GPTT_STRING_MAX) {
! 			/* This is almost impossible condition - long pad */
! 			offset = glyf + GUINT16FROMPTR (buf + loca + 2 * numGlyphs) * 2;
! 			slices = g_slist_prepend (slices, GUINT_TO_POINTER (offset));
! 			start = offset;
  		}
  		break;
  	case 1:
  		/* Long offsets */
  		for (i = 0; i < numGlyphs; i++) {
! 			offset = glyf + GUINT32FROMPTR (buf + loca + 4 * i + 4) * 2;
! 			if ((offset - start) > GPTT_STRING_MAX) {
! 				/* Write down current offset */
! 				offset = glyf + GUINT32FROMPTR (buf + loca + 4 * i) * 2;
! 				slices = g_slist_prepend (slices, GUINT_TO_POINTER (offset));
! 				start = offset;
! 			}
! 		}
! 		if ((next - start) > GPTT_STRING_MAX) {
! 			/* This is almost impossible condition - long pad */
! 			offset = glyf + GUINT32FROMPTR (buf + loca + 4 * numGlyphs) * 2;
! 			slices = g_slist_prepend (slices, GUINT_TO_POINTER (offset));
! 			start = offset;
  		}
  		break;
  	default:
--- 141,170 ----
  	guint16 numGlyphs;
  	guint32 start;
  	guint32 offset;
+ 	guint32 nextOffset;
  	gint i;
+ 	GSList *offsets;
  
  	indexToLocFormat = GUINT16FROMPTR (buf + head + 52);
  	numGlyphs = GUINT16FROMPTR (buf + maxp + 4);
  
  	start = glyf;
  
+ 	offsets = g_slist_prepend(NULL, GUINT_TO_POINTER(glyf));
+ 
  	switch (indexToLocFormat) {
  	case 0:
  		/* Short offsets */
  		for (i = 0; i < numGlyphs; i++) {
  			offset = glyf + GUINT16FROMPTR (buf + loca + 2 * i + 2) * 2;
! 			offsets = g_slist_prepend(offsets, GUINT_TO_POINTER(offset));
  		}
  		break;
  	case 1:
  		/* Long offsets */
  		for (i = 0; i < numGlyphs; i++) {
! 			offset = glyf + GUINT32FROMPTR (buf + loca + 4 * i + 4);
! 			offsets = g_slist_prepend(offsets, GUINT_TO_POINTER(offset));
  		}
  		break;
  	default:
***************
*** 192,198 ****
  		break;
  	}
  
! 	if ((next - start) > GPTT_STRING_MAX) {
  		g_warning ("Too big pad at the end of 'glyf' table");
  		g_slist_free (slices);
  		return NULL;
--- 174,196 ----
  		break;
  	}
  
! 	offsets = g_slist_sort (offsets, gp_tt_offset_compare);
! 
! 	while (offsets)
! 	{
! 		offset = GPOINTER_TO_UINT(offsets->data);
! 		offsets = g_slist_remove (offsets, offsets->data);
! 
! 		nextOffset = offsets ? GPOINTER_TO_UINT(offsets->data) : next;
! 
! 		if ((nextOffset - start) >= GPTT_STRING_MAX)
! 		{
! 			slices = g_slist_prepend (slices, GUINT_TO_POINTER (offset));
! 			start = offset;
! 		}
! 	}
! 
! 	if ((next - start) >= GPTT_STRING_MAX) {
  		g_warning ("Too big pad at the end of 'glyf' table");
  		g_slist_free (slices);
  		return NULL;
