diff --git a/gfx/ots/src/cff.cc b/gfx/ots/src/cff.cc
index 95ff7f744b6..3488f471b9c 100644
--- a/gfx/ots/src/cff.cc
+++ b/gfx/ots/src/cff.cc
@@ -556,7 +556,7 @@ bool ParsePrivateDictData(
           return OTS_FAILURE();
         }
         uint16_t k = out_cff->region_index_count.at(vsindex);
-          
+
         if (operands.back().first > static_cast<uint16_t>(0xffff) || operands.back().first < 0){
           return OTS_FAILURE();
         }
@@ -1050,21 +1050,18 @@ bool ParseDictData(ots::Buffer& table, ots::Buffer& dict,
         if (operands.size() != 2) {
           return OTS_FAILURE();
         }
-        if (operands.back().second != DICT_OPERAND_INTEGER) {
+        if (!CheckOffset(operands.back(), table.length())) {
           return OTS_FAILURE();
         }
         const int32_t private_offset = operands.back().first;
         operands.pop_back();
-        if (operands.back().second != DICT_OPERAND_INTEGER) {
+        // The next operand is a length, not an offset, but we can usefully apply the same check:
+        // if it is negative or exceeds the table length, it cannot be valid.
+        if (!CheckOffset(operands.back(), table.length())) {
           return OTS_FAILURE();
         }
         const int32_t private_length = operands.back().first;
-        if (private_offset > static_cast<int32_t>(table.length())) {
-          return OTS_FAILURE();
-        }
-        if (private_length >= static_cast<int32_t>(table.length()) || private_length < 0) {
-          return OTS_FAILURE();
-        }
+        // The offset & length were individually plausible; check that the combination doesn't overflow the table.
         if (private_length + private_offset > static_cast<int32_t>(table.length()) || private_length + private_offset < 0) {
           return OTS_FAILURE();
         }