From 2cc845f311b6dc4f0feda8b8fc5609fbd51b5923 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Tue, 20 Feb 2018 18:13:41 -0800
Subject: [PATCH] [subset] fix calculation of range shiftz. Should be 16 * len
 - searchRange not 16 * (len - searchRange).

---
 src/hb-open-type-private.hh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/hb-open-type-private.hh b/src/hb-open-type-private.hh
index 080dcca1b..54eda4c52 100644
--- a/src/hb-open-type-private.hh
+++ b/src/hb-open-type-private.hh
@@ -1113,7 +1113,9 @@ struct BinSearchHeader
     assert (len == v);
     entrySelectorZ.set (MAX (1u, _hb_bit_storage (v)) - 1);
     searchRangeZ.set (16 * (1u << entrySelectorZ));
-    rangeShiftZ.set (16 * MAX (0, (int) v - searchRangeZ));
+    rangeShiftZ.set (v * 16 > searchRangeZ
+                     ? 16 * v - searchRangeZ
+                     : 0);
   }
 
   protected: