CVE-2010-0421
--- a/pango/opentype/harfbuzz-gdef.c
+++ b/pango/opentype/harfbuzz-gdef.c
@@ -923,7 +923,7 @@ HB_Error  HB_GDEF_Build_ClassDefinition(
 	    goto Fail1;
       }
 
-      if ( gcrr[count - 1].End != num_glyphs - 1 )
+      if ( gcrr[count - 1].End + 1 < num_glyphs )
       {
 	if ( ALLOC_ARRAY( ngc[count],
 			  ( num_glyphs - gcrr[count - 1].End + 2 ) / 4,
@@ -938,7 +938,9 @@ HB_Error  HB_GDEF_Build_ClassDefinition(
 			HB_UShort ) )
 	  goto Fail2;
   }
-      
+  else
+    num_glyphs = 1;
+
   gdef->LastGlyph = num_glyphs - 1;
 
   gdef->MarkAttachClassDef_offset = 0L;
@@ -996,6 +998,8 @@ _HB_GDEF_Add_Glyph_Property( HB_GDEFHead
   HB_ClassRangeRecord*  gcrr;
   HB_UShort**            ngc;
 
+  if ( glyphID >= gdef->LastGlyph )
+    return 0;
 
   error = _HB_OPEN_Get_Class( &gdef->GlyphClassDef, glyphID, &class, &index );
   if ( error && error != HB_Err_Not_Covered )