diff --git a/perf/benchmark-ot.cc b/perf/benchmark-ot.cc
index c9edef303..7b122d40f 100644
--- a/perf/benchmark-ot.cc
+++ b/perf/benchmark-ot.cc
@@ -27,6 +27,9 @@ static void BM_hb_ot_tags_from_script_and_language (benchmark::State& state,
 					 language_tags /* OUT */);
   }
 }
+BENCHMARK_CAPTURE (BM_hb_ot_tags_from_script_and_language, COMMON zh_trad, HB_SCRIPT_COMMON, "zh_trad");
+BENCHMARK_CAPTURE (BM_hb_ot_tags_from_script_and_language, COMMON ab_abcd, HB_SCRIPT_COMMON, "ab_abcd");
+BENCHMARK_CAPTURE (BM_hb_ot_tags_from_script_and_language, COMMON ab_abc, HB_SCRIPT_COMMON, "ab_abc");
 BENCHMARK_CAPTURE (BM_hb_ot_tags_from_script_and_language, COMMON abcdef_XY, HB_SCRIPT_COMMON, "abcdef_XY");
 BENCHMARK_CAPTURE (BM_hb_ot_tags_from_script_and_language, COMMON abcd_XY, HB_SCRIPT_COMMON, "abcd_XY");
 BENCHMARK_CAPTURE (BM_hb_ot_tags_from_script_and_language, COMMON cxy_CN, HB_SCRIPT_COMMON, "cxy_CN");
diff --git a/src/gen-tag-table.py b/src/gen-tag-table.py
index d8c5a2fcf..16b6818fa 100755
--- a/src/gen-tag-table.py
+++ b/src/gen-tag-table.py
@@ -1028,6 +1028,8 @@ min_subtag_len += 1 # For initial '-'
 print ('  if (limit - lang_str > %d ||' % min_subtag_len)
 print ("      (limit - lang_str == %d && *lang_str == '-'))" % min_subtag_len)
 print ('  {')
+print ("    const char *p = strchr (lang_str, '-');")
+print ("    if (!p || p >= limit || limit - p < %i) goto out;" % min_subtag_len)
 for initial, items in sorted (complex_tags.items ()):
 	if initial != 'und':
 		continue
@@ -1061,6 +1063,7 @@ for initial, items in sorted (complex_tags.items ()):
 		print ('      return true;')
 		print ('    }')
 print ('  }')
+print ('out:')
 
 print ('  switch (lang_str[0])')
 print ('  {')
diff --git a/src/hb-ot-tag-table.hh b/src/hb-ot-tag-table.hh
index bcf40123a..c2a548704 100644
--- a/src/hb-ot-tag-table.hh
+++ b/src/hb-ot-tag-table.hh
@@ -1645,6 +1645,8 @@ hb_ot_tags_from_complex_language (const char   *lang_str,
   if (limit - lang_str > 5 ||
       (limit - lang_str == 5 && *lang_str == '-'))
   {
+    const char *p = strchr (lang_str, '-');
+    if (!p || p >= limit || limit - p < 5) goto out;
     if (subtag_matches (lang_str, limit, "-fonnapa", 8))
     {
       /* Undetermined; North American Phonetic Alphabet */
@@ -1709,6 +1711,7 @@ hb_ot_tags_from_complex_language (const char   *lang_str,
       return true;
     }
   }
+out:
   switch (lang_str[0])
   {
   case 'a':