diff --git a/src/sfnt.c b/src/sfnt.c
index 1832082e4f9..8b7392b3af2 100644
--- a/src/sfnt.c
+++ b/src/sfnt.c
@@ -14085,22 +14085,18 @@ sfnt_map_table (int fd, struct sfnt_offset_subtable *subtable,
   struct sfnt_table_directory *directory;
   size_t offset, page, map_offset;
   void *data;
-  int i;
 
   /* Find the table in the directory.  */
 
-  for (i = 0; i < subtable->num_tables; ++i)
+  for (int i = 0; ; i++)
     {
-      if (subtable->subtables[i].tag == tag)
-	{
-	  directory = &subtable->subtables[i];
-	  break;
-	}
+      if (! (i < subtable->num_tables))
+	return 1;
+      directory = &subtable->subtables[i];
+      if (directory->tag == tag)
+	break;
     }
 
-  if (i == subtable->num_tables)
-    return 1;
-
   /* Now try to map the glyph data.  Make sure offset is a multiple of
      the page size.  */
 
@@ -14152,22 +14148,18 @@ sfnt_read_table (int fd, struct sfnt_offset_subtable *subtable,
 {
   struct sfnt_table_directory *directory;
   void *data;
-  int i;
 
   /* Find the table in the directory.  */
 
-  for (i = 0; i < subtable->num_tables; ++i)
+  for (int i = 0; ; i++)
     {
-      if (subtable->subtables[i].tag == tag)
-	{
-	  directory = &subtable->subtables[i];
-	  break;
-	}
+      if (! (i < subtable->num_tables))
+	return NULL;
+      directory = &subtable->subtables[i];
+      if (directory->tag == tag)
+	break;
     }
 
-  if (i == subtable->num_tables)
-    return NULL;
-
   /* Seek to the table.  */
 
   if (lseek (fd, directory->offset, SEEK_SET) != directory->offset)
@@ -15160,7 +15152,7 @@ sfnt_read_cvar_table (int fd, struct sfnt_offset_subtable *subtable,
 	  /* Copy in the shared point numbers instead.  */
 	  cvar->variation[i].num_points = npoints;
 
-	  if (npoints != UINT16_MAX)
+	  if (points && npoints != UINT16_MAX)
 	    {
 	      if (cvar->variation[i].num_points > cvt->num_elements)
 		cvar->variation[i].num_points = cvt->num_elements;