diff --git a/src/hb-ot-glyf-table.hh b/src/hb-ot-glyf-table.hh
index 4b938017b74a2625a113bc29b9847b5944bbe111..c92f63f4c484d5acbda8a6cef8cddc778914710e 100644
--- a/src/hb-ot-glyf-table.hh
+++ b/src/hb-ot-glyf-table.hh
@@ -286,7 +286,7 @@ struct glyf
       static const int FLAG_Y_SAME = 0x20;
 
       if (*end_offset - start_offset < GlyphHeader::static_size)
-        return false;
+        return true;
 
       const char *glyph = ((const char *) glyf_table) + start_offset;
       const char * const glyph_end = glyph + (*end_offset - start_offset);
@@ -313,7 +313,7 @@ struct glyf
         while (glyph < glyph_end)
         {
           uint8_t flag = (uint8_t) *glyph;
-          glyph++; i++;
+          glyph++;
 
           unsigned int repeat = 1;
           if (flag & FLAG_REPEAT)
@@ -324,7 +324,7 @@ struct glyf
               return false;
             }
             repeat = ((uint8_t) *glyph) + 1;
-            glyph++; i++;
+            glyph++;
           }
 
           unsigned int xBytes, yBytes;
diff --git a/src/hb-subset-glyf.cc b/src/hb-subset-glyf.cc
index 052af3f4df6ad8a09237eec5919b29084609a870..ce7c99fe1de44ad07d0fdbc98fb23e6f7284c067 100644
--- a/src/hb-subset-glyf.cc
+++ b/src/hb-subset-glyf.cc
@@ -230,8 +230,8 @@ _hb_subset_glyf_and_loca (const OT::glyf::accelerator_t  &glyf,
     return false;
   }
 
-  char *glyf_prime_data = (char *) malloc (glyf_prime_size);
-  char *loca_prime_data = (char *) malloc (loca_prime_size);
+  char *glyf_prime_data = (char *) calloc (1, glyf_prime_size);
+  char *loca_prime_data = (char *) calloc (1, loca_prime_size);
   if (unlikely (!_write_glyf_and_loca_prime (plan, glyf, glyf_data,
                                              *use_short_loca,
                                              instruction_ranges,
diff --git a/test/api/test-subset-glyf.c b/test/api/test-subset-glyf.c
index 2f266d07a4068c2b3e4434ea076f457f7cb84876..f5fdf32d0ec211a9c84b8b517582aad22ff987cb 100644
--- a/test/api/test-subset-glyf.c
+++ b/test/api/test-subset-glyf.c
@@ -31,6 +31,18 @@
 
 /* Unit tests for hb-subset-glyf.h */
 
+static void check_maxp_num_glyphs (hb_face_t *face, uint16_t expected_num_glyphs)
+{
+  hb_blob_t *maxp_blob = hb_face_reference_table (face, HB_TAG ('m','a','x', 'p'));
+
+  unsigned int maxp_len;
+  uint8_t *raw_maxp = (uint8_t *) hb_blob_get_data(maxp_blob, &maxp_len);
+  uint16_t num_glyphs = (raw_maxp[4] << 8) + raw_maxp[5];
+  g_assert_cmpuint(expected_num_glyphs, ==, num_glyphs);
+
+  hb_blob_destroy (maxp_blob);
+}
+
 static void
 test_subset_glyf (void)
 {
@@ -45,7 +57,7 @@ test_subset_glyf (void)
 
   hb_subset_test_check (face_ac, face_abc_subset, HB_TAG ('g','l','y','f'));
   hb_subset_test_check (face_ac, face_abc_subset, HB_TAG ('l','o','c', 'a'));
-  hb_subset_test_check (face_ac, face_abc_subset, HB_TAG ('m','a','x', 'p'));
+  check_maxp_num_glyphs(face_abc_subset, 3);
 
   hb_face_destroy (face_abc_subset);
   hb_face_destroy (face_abc);
@@ -65,7 +77,7 @@ test_subset_glyf_with_components (void)
 
   hb_subset_test_check (face_subset, face_generated_subset, HB_TAG ('g','l','y','f'));
   hb_subset_test_check (face_subset, face_generated_subset, HB_TAG ('l','o','c', 'a'));
-  hb_subset_test_check (face_subset, face_generated_subset, HB_TAG ('m','a','x', 'p'));
+  check_maxp_num_glyphs(face_generated_subset, 4);
 
   hb_face_destroy (face_generated_subset);
   hb_face_destroy (face_subset);
@@ -86,6 +98,7 @@ test_subset_glyf_noop (void)
 
   hb_subset_test_check (face_abc, face_abc_subset, HB_TAG ('g','l','y','f'));
   hb_subset_test_check (face_abc, face_abc_subset, HB_TAG ('l','o','c', 'a'));
+  check_maxp_num_glyphs(face_abc_subset, 4);
 
   hb_face_destroy (face_abc_subset);
   hb_face_destroy (face_abc);
@@ -107,7 +120,7 @@ test_subset_glyf_strip_hints (void)
 
   hb_subset_test_check (face_ac, face_abc_subset, HB_TAG ('l','o','c', 'a'));
   hb_subset_test_check (face_ac, face_abc_subset, HB_TAG ('g','l','y','f'));
-  hb_subset_test_check (face_ac, face_abc_subset, HB_TAG ('m','a','x', 'p'));
+  check_maxp_num_glyphs(face_abc_subset, 3);
 
   hb_face_destroy (face_abc_subset);
   hb_face_destroy (face_abc);