diff --git a/ChangeLog b/ChangeLog
index 454b8ae..1660afa 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2019-12-03  Werner Lemberg  <wl@gnu.org>
+
+	More nullptr offset UBSan warnings (#57331, #57347).
+
+	* src/autofit/afcjk.c (af_cjk_hints_compute_segments),
+	src/psaux/psft.c (cf2_getSeacComponent), src/truetype/ttinterp.c
+	(Ins_UNKNOWN): Use `FT_OFFSET'.
+
 2019-11-29  Dominik Röttsches  <drott@chromium.org>
 
 	Avoid more nullptr offset UBSan warnings (#57316).
diff --git a/src/autofit/afcjk.c b/src/autofit/afcjk.c
index a61689b..3bae4ec 100644
--- a/src/autofit/afcjk.c
+++ b/src/autofit/afcjk.c
@@ -806,7 +806,7 @@
   {
     AF_AxisHints  axis          = &hints->axis[dim];
     AF_Segment    segments      = axis->segments;
-    AF_Segment    segment_limit = segments + axis->num_segments;
+    AF_Segment    segment_limit = FT_OFFSET( segments, axis->num_segments );
     FT_Error      error;
     AF_Segment    seg;
 
diff --git a/src/psaux/psft.c b/src/psaux/psft.c
index a823ac8..7c7ef2c 100644
--- a/src/psaux/psft.c
+++ b/src/psaux/psft.c
@@ -700,7 +700,7 @@
     FT_ASSERT( charstring + len >= charstring );
 
     buf->start = charstring;
-    buf->end   = charstring + len;
+    buf->end   = FT_OFFSET( charstring, len );
     buf->ptr   = buf->start;
 
     return FT_Err_Ok;
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index 70434e1..1357890 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -7715,7 +7715,7 @@
   Ins_UNKNOWN( TT_ExecContext  exc )
   {
     TT_DefRecord*  def   = exc->IDefs;
-    TT_DefRecord*  limit = def + exc->numIDefs;
+    TT_DefRecord*  limit = FT_OFFSET( def, exc->numIDefs );
 
 
     for ( ; def < limit; def++ )