[uniscribe] Fix scratch-buffer accounting

src/hb-uniscribe.cc

@@ -776,13 +776,14 @@ retry:
     }
   }
 
-  /* All the following types are sized in multiples of sizeof(int). */
-  unsigned int glyphs_size = scratch_size / ((sizeof (WORD) +
-					      sizeof (SCRIPT_GLYPHPROP) +
-					      sizeof (int) +
-					      sizeof (GOFFSET) +
-					      sizeof (uint32_t))
-					     / sizeof (int));
+  /* The -2 in the following is to compensate for possible
+   * alignment needed after the WORD array.  sizeof(WORD) == 2. */
+  unsigned int glyphs_size = (scratch_size * sizeof (int) - 2)
+			   / (sizeof (WORD) +
+			      sizeof (SCRIPT_GLYPHPROP) +
+			      sizeof (int) +
+			      sizeof (GOFFSET) +
+			      sizeof (uint32_t));
 
   ALLOCATE_ARRAY (WORD, glyphs, glyphs_size);
   ALLOCATE_ARRAY (SCRIPT_GLYPHPROP, glyph_props, glyphs_size);