.

common/FontsFreeType/Private/FreeType/base.js

@@ -542,6 +542,7 @@ FT_Stream.prototype =
                 case 24:  /* read a byte sequence */
                 case 25:   /* skip some bytes      */
                 {
+					var len = fields[ind].size;
                     if ( cursor + fsize > this.size )
                     {
                         error = FT_Common.FT_Err_Invalid_Stream_Operation;

common/FontsFreeType/Private/FreeType/drivers/cff.js

@@ -4959,7 +4959,7 @@ function cff_decoder_parse_charstrings(decoder, charstring_base, charstring_len)
                 }
 
                 case FT_Common.cff_op_mul:
-                    topsargs[0] = FT_MulFix( args[0], args[1] );
+                    tops[args] = FT_MulFix( args[0], args[1] );
                     args++;
                     break;
 
@@ -5700,7 +5700,7 @@ function cff_get_glyph_name(face, glyph_index, buffer, buffer_max)
 function cff_get_name_index(face, glyph_name)
 {
     var cff = face.extra.data;
-    var charset = cf.charset;
+    var charset = cff.charset;
 
     var psnames = FT_FACE_FIND_GLOBAL_SERVICE(face, FT_SERVICE_ID_POSTSCRIPT_CMAPS);
     if (psnames == null)

common/FontsFreeType/font_engine.js

@@ -907,6 +907,7 @@ FT_Stream.prototype =
                 case 24:  /* read a byte sequence */
                 case 25:   /* skip some bytes      */
                 {
+					var len = fields[ind].size;
                     if ( cursor + fsize > this.size )
                     {
                         error = 85;
@@ -35868,7 +35869,7 @@ function cff_decoder_parse_charstrings(decoder, charstring_base, charstring_len)
                 }
 
                 case 32:
-                    topsargs[0] = FT_MulFix( args[0], args[1] );
+                    tops[args] = FT_MulFix( args[0], args[1] );
                     args++;
                     break;
 

common/Native/Wrappers/memory.js

@@ -583,6 +583,7 @@ function FT_Stream(data, size)
                 case 24:  /* read a byte sequence */
                 case 25:   /* skip some bytes      */
                 {
+					var len = arrayFields[ind].size;
                     if ( cursor + fsize > this.size )
                     {
                         error = 85;
@@ -594,7 +595,7 @@ function FT_Stream(data, size)
                     if ( fval == 24 )
                     {
                         data = structure.data;
-                        pos = structure.pos + arrayFields[ind].offset;
+                        pos = structure.pos + fields[ind].offset;
 
                         for (var i=0;i<len;i++)
                             data[i] = this.data[cursor+i];
@@ -661,8 +662,8 @@ function FT_Stream(data, size)
             /* finally, store the value in the object */
 
             data = structure.data;
-            pos = structure.pos + arrayFields[ind].offset;
-            switch (arrayFields[ind])
+            pos = structure.pos + fields[ind].offset;
+            switch (fields[ind])
             {
                 case 1:
                     data[pos] = value & 0xFF;