diff --git a/ChangeLog b/ChangeLog
index fa747bbe9..d436f20a3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2006-09-29  Werner Lemberg  <wl@gnu.org>
+
+	* src/sfnt/ttcmap.c (tt_cmap4_char_map_binary): Fix algorithm for
+	overlapping segments.  Bug reported by Stefan Koch.
+
 2006-09-28  David Turner  <david@freetype.org>
 
         * include/freetype/internal/ftobjs.h, src/truetype/ttobjs.c,
diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c
index ce1dc0c8c..7795105ae 100644
--- a/src/sfnt/ttcmap.c
+++ b/src/sfnt/ttcmap.c
@@ -1094,14 +1094,19 @@
           /* search in segments before the current segment */
           for ( i = max ; i > 0; i-- )
           {
-            FT_UInt  prev_end;
+            FT_UInt   prev_end;
+            FT_Byte*  old_p;
 
 
-            p = cmap->data + 14 + ( i - 1 ) * 2;
+            old_p    = p;
+            p        = cmap->data + 14 + ( i - 1 ) * 2;
             prev_end = TT_PEEK_USHORT( p );
 
             if ( charcode > prev_end )
+            {
+              p = old_p;
               break;
+            }
 
             end    = prev_end;
             p     += 2 + num_segs2;