fixed two bugs:

  - one bug in the auto-hinter that could cause some program
    crashes with certain fonts

  - fixed the loading of the font matrix "offset" parameters
    in Type 1 and CID-keyed fonts..

src/autohint/ahglyph.c

@@ -332,14 +332,14 @@
       FT_Int  max  = outline->max_points;
 
 
-      if ( REALLOC_ARRAY( outline->points, max, news, AH_Point )          ||
-           REALLOC_ARRAY( outline->horz_edges, max, news, AH_Edge )       ||
-           REALLOC_ARRAY( outline->horz_segments, max, news, AH_Segment ) )
+      if ( REALLOC_ARRAY( outline->points, max, news, AH_Point )            ||
+           REALLOC_ARRAY( outline->horz_edges, max*2, news*2, AH_Edge )     ||
+           REALLOC_ARRAY( outline->horz_segments, max*2, news*2, AH_Segment ) )
         goto Exit;
 
       /* readjust some pointers */
-      outline->vert_edges    = outline->horz_edges + ( news >> 1 );
-      outline->vert_segments = outline->horz_segments + ( news >> 1 );
+      outline->vert_edges    = outline->horz_edges    + news;
+      outline->vert_segments = outline->horz_segments + news;
       outline->max_points    = news;
     }
 

src/cid/cidload.c

@@ -219,8 +219,11 @@
       matrix->yx = temp[1];
       matrix->xy = temp[2];
       matrix->yy = temp[3];
-      offset->x  = temp[4];
-      offset->y  = temp[5];
+      
+      /* note that the font offset are expressed in */
+      /* integer font units..                       */
+      offset->x  = temp[4] >> 16;
+      offset->y  = temp[5] >> 16;
     }
 
     return T1_Err_Ok;       /* this is a callback function; */

src/type1z/z1load.c

@@ -912,8 +912,11 @@
     matrix->yx = temp[1];
     matrix->xy = temp[2];
     matrix->yy = temp[3];
-    offset->x  = temp[4];
-    offset->y  = temp[5];
+    
+    /* note that the offset must be expressed in */
+    /* integer font units..                      */
+    offset->x  = temp[4] >> 16;
+    offset->y  = temp[5] >> 16;
   }