diff --git a/gfx/thebes/src/woff.c b/gfx/thebes/src/woff.c
--- a/gfx/thebes/src/woff.c
+++ b/gfx/thebes/src/woff.c
@@ -621,17 +621,17 @@ failure:
 /******************************************************************/
 
 static uint32_t
 sanityCheck(const uint8_t * woffData, uint32_t woffLen)
 {
   const woffHeader * header;
   uint16_t numTables, i;
   const woffDirEntry * dirEntry;
-  uint32_t tableTotal = 0;
+  uint64_t tableTotal = 0;
 
   if (!woffData || !woffLen) {
     return eWOFF_bad_parameter;
   }
 
   if (woffLen < sizeof(woffHeader)) {
     return eWOFF_invalid;
   }
@@ -647,24 +647,25 @@ sanityCheck(const uint8_t * woffData, ui
 
   numTables = READ16BE(header->numTables);
   if (woffLen < sizeof(woffHeader) + numTables * sizeof(woffDirEntry)) {
     return eWOFF_invalid;
   }
 
   dirEntry = (const woffDirEntry *) (woffData + sizeof(woffHeader));
   for (i = 0; i < numTables; ++i) {
-    uint32_t offs = READ32BE(dirEntry->offset);
-    uint32_t orig = READ32BE(dirEntry->origLen);
-    uint32_t comp = READ32BE(dirEntry->compLen);
+    uint64_t offs = READ32BE(dirEntry->offset);
+    uint64_t orig = READ32BE(dirEntry->origLen);
+    uint64_t comp = READ32BE(dirEntry->compLen);
     if (comp > orig || comp > woffLen || offs > woffLen - comp) {
       return eWOFF_invalid;
     }
     orig = (orig + 3) & ~3;
-    if (tableTotal > 0xffffffffU - orig) {
+    tableTotal += orig;
+    if (tableTotal > 0xffffffffU) {
       return eWOFF_invalid;
     }
     tableTotal += orig;
     ++dirEntry;
   }
 
   if (tableTotal > 0xffffffffU - sizeof(sfntHeader) -
                                  numTables * sizeof(sfntDirEntry) ||
