--- freetype-2.2.1/src/sfnt/ttcmap.c.orig	2006-04-21 21:05:29.000000000 -0700
+++ freetype-2.2.1/src/sfnt/ttcmap.c	2006-09-30 22:30:24.000000000 -0700
@@ -1095,13 +1095,17 @@
           for ( i = max ; i > 0; i-- )
           {
             FT_UInt  prev_end;
+	    FT_Byte*  old_p;
 
-
+	    old_p    = p;
             p = cmap->data + 14 + ( i - 1 ) * 2;
             prev_end = TT_PEEK_USHORT( p );
 
             if ( charcode > prev_end )
+	    {
+	      p = old_p;
               break;
+	    }
 
             end    = prev_end;
             p     += 2 + num_segs2;
@@ -2273,7 +2277,7 @@
 
       if ( offset && offset <= face->cmap_size - 2 )
       {
-        FT_Byte*                       cmap   = table + offset;
+        FT_Byte* volatile              cmap   = table + offset;
         volatile FT_UInt               format = TT_PEEK_USHORT( cmap );
         const TT_CMap_Class* volatile  pclazz = tt_cmap_classes;
         TT_CMap_Class volatile         clazz;