* src/truetype/ttgxvar.c (tt_set_mm_blend): Fix off-by-one error.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9412

2 files changed, 13 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 87f3d1795..9ce63689c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2018-07-16  Werner Lemberg  <wl@gnu.org>
+
+	* src/truetype/ttgxvar.c (tt_set_mm_blend): Fix off-by-one error.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9412
+
 2018-07-12  Werner Lemberg  <wl@gnu.org>
 
 	* src/base/ftoutln.c (FT_Outline_Get_Orientation): Init `cbox'.
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 0937301b0..d143fcefc 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -2533,11 +2533,14 @@
 
       if ( FT_IS_NAMED_INSTANCE( FT_FACE( face ) ) )
       {
-        FT_UInt  idx = (FT_UInt)face->root.face_index >> 16;
+        FT_UInt  instance_index = (FT_UInt)face->root.face_index >> 16;
 
 
         c = blend->normalizedcoords + i;
-        n = blend->normalized_stylecoords + idx * mmvar->num_axis + i;
+        n = blend->normalized_stylecoords            +
+            ( instance_index - 1 ) * mmvar->num_axis +
+            i;
+
         for ( j = i; j < mmvar->num_axis; j++, n++, c++ )
           if ( *c != *n )
             have_diff = 1;