| Index: src/hdmx.cc
 | 
| diff --git a/src/hdmx.cc b/src/hdmx.cc
 | 
| index c30ac4893fb6b3c9ebf9a526d61e247121138310..570fab1682b2d38cb8623240f3b4beeee273bd5d 100644
 | 
| --- a/src/hdmx.cc
 | 
| +++ b/src/hdmx.cc
 | 
| @@ -105,13 +105,16 @@ bool ots_hdmx_should_serialise(OpenTypeFile *file) {
 | 
|  bool ots_hdmx_serialise(OTSStream *out, OpenTypeFile *file) {
 | 
|    OpenTypeHDMX * const hdmx = file->hdmx;
 | 
|  
 | 
| -  if (!out->WriteU16(hdmx->version) ||
 | 
| -      !out->WriteS16(hdmx->records.size()) ||
 | 
| +  const int16_t num_recs = static_cast<int16_t>(hdmx->records.size());
 | 
| +  if (hdmx->records.size() >
 | 
| +          static_cast<size_t>(std::numeric_limits<int16_t>::max()) ||
 | 
| +      !out->WriteU16(hdmx->version) ||
 | 
| +      !out->WriteS16(num_recs) ||
 | 
|        !out->WriteS32(hdmx->size_device_record)) {
 | 
|      return OTS_FAILURE();
 | 
|    }
 | 
|  
 | 
| -  for (unsigned i = 0; i < hdmx->records.size(); ++i) {
 | 
| +  for (int16_t i = 0; i < num_recs; ++i) {
 | 
|      const OpenTypeHDMXDeviceRecord& rec = hdmx->records[i];
 | 
|      if (!out->Write(&rec.pixel_size, 1) ||
 | 
|          !out->Write(&rec.max_width, 1) ||
 | 
| 
 |