diff --git a/ChangeLog b/ChangeLog
index 9934abc..55ba0bf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2008-03-03  Masatoshi Kimura  <VYV03354@nifty.ne.jp>
+
+	* src/sfnt/ttcmap.c (tt_cmap14_char_map_nondef_binary,
+	tt_cmap14_find_variant): Return correct value.
+	(tt_cmap14_variant_chars): Fix check for `di'.
+
 2008-02-29  Wermer Lemberg  <wl@gnu.org>
 
 	* docs/CHANGES: Updated.
diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c
index dac23a8..b70b64c 100644
--- a/src/sfnt/ttcmap.c
+++ b/src/sfnt/ttcmap.c
@@ -2546,7 +2546,7 @@
     {
       FT_UInt32  mid = ( min + max ) >> 1;
       FT_Byte*   p   = base + 5 * mid;
-      FT_UInt32  uni = TT_PEEK_UINT24( p );
+      FT_UInt32  uni = TT_NEXT_UINT24( p );
 
 
       if ( char_code < uni )
@@ -2579,7 +2579,7 @@
     {
       FT_UInt32  mid    = ( min + max ) >> 1;
       FT_Byte*   p      = base + 11 * mid;
-      FT_ULong   varSel = TT_PEEK_UINT24( p );
+      FT_ULong   varSel = TT_NEXT_UINT24( p );
 
 
       if ( variantCode < varSel )
@@ -2913,7 +2913,7 @@
           ++ni;
         }
       }
-      else if ( di < numRanges )
+      else if ( di <= numRanges )
       {
         /* If we get here then we have run out of all non-default     */
         /* mappings.  We have read one default range which we haven't */