diff --git a/ChangeLog b/ChangeLog
index ae817b9cc..4f0809563 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,16 @@
+2012-02-29  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Fix Savannah bug #35601.
+
+	* src/truetype/ttinterp.c (Ins_SHZ): Use number of points instead of
+	last point for loop.
+	Also remove redundant boundary check.
+
 2012-02-29  Werner Lemberg  <wl@gnu.org>
 
 	[truetype] Remove redundant check.
 
-	* src/truetype/ttgload.c (TT_Load_Simple_Glyph): Remove reduntant
+	* src/truetype/ttgload.c (TT_Load_Simple_Glyph): Remove redundant
 	second check for ordered contour start points.
 
 2012-02-29  Werner Lemberg  <wl@gnu.org>
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index b742d78af..d0733b060 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -5833,7 +5833,7 @@
     FT_F26Dot6       dx,
                      dy;
 
-    FT_UShort        last_point, i;
+    FT_UShort        limit, i;
 
 
     if ( BOUNDS( args[0], 2 ) )
@@ -5850,24 +5850,15 @@
     /*      Twilight zone has no real contours, so use `n_points'. */
     /*      Normal zone's `n_points' includes phantoms, so must    */
     /*      use end of last contour.                               */
-    if ( CUR.GS.gep2 == 0 && CUR.zp2.n_points > 0 )
-      last_point = (FT_UShort)( CUR.zp2.n_points - 1 );
+    if ( CUR.GS.gep2 == 0 )
+      limit = (FT_UShort)CUR.zp2.n_points;
     else if ( CUR.GS.gep2 == 1 && CUR.zp2.n_contours > 0 )
-    {
-      last_point = (FT_UShort)( CUR.zp2.contours[CUR.zp2.n_contours - 1] );
-
-      if ( BOUNDS( last_point, CUR.zp2.n_points ) )
-      {
-        if ( CUR.pedantic_hinting )
-          CUR.error = TT_Err_Invalid_Reference;
-        return;
-      }
-    }
+      limit = (FT_UShort)( CUR.zp2.contours[CUR.zp2.n_contours - 1] + 1 );
     else
-      last_point = 0;
+      limit = 0;
 
     /* XXX: UNDOCUMENTED! SHZ doesn't touch the points */
-    for ( i = 0; i <= last_point; i++ )
+    for ( i = 0; i < limit; i++ )
     {
       if ( zp.cur != CUR.zp2.cur || refp != i )
         MOVE_Zp2_Point( i, dx, dy, FALSE );