diff --git a/src/hb-ot-cff1-table.hh b/src/hb-ot-cff1-table.hh
index 1effdf0..9d39242 100644
--- a/src/hb-ot-cff1-table.hh
+++ b/src/hb-ot-cff1-table.hh
@@ -59,14 +59,14 @@
   bool sanitize (hb_sanitize_context_t *c) const
   {
     TRACE_SANITIZE (this);
-    return_trace (c->check_struct (this) && codes[nCodes - 1].sanitize (c));
+    return_trace (codes.sanitize (c));
   }
 
   hb_codepoint_t get_code (hb_codepoint_t glyph) const
   {
     assert (glyph > 0);
     glyph--;
-    if (glyph < nCodes)
+    if (glyph < nCodes ())
     {
       return (hb_codepoint_t)codes[glyph];
     }
@@ -74,13 +74,12 @@
       return CFF_UNDEF_CODE;
   }
 
-  unsigned int get_size () const
-  { return HBUINT8::static_size * (nCodes + 1); }
+  HBUINT8 &nCodes () { return codes.len; }
+  HBUINT8 nCodes () const { return codes.len; }
 
-  HBUINT8     nCodes;
-  HBUINT8     codes[VAR];
+  ArrayOf<HBUINT8, HBUINT8> codes;
 
-  DEFINE_SIZE_ARRAY(1, codes);
+  DEFINE_SIZE_ARRAY_SIZED (1, codes);
 };
 
 struct Encoding1_Range {
@@ -97,20 +96,17 @@
 };
 
 struct Encoding1 {
-  unsigned int get_size () const
-  { return HBUINT8::static_size + Encoding1_Range::static_size * nRanges; }
-
   bool sanitize (hb_sanitize_context_t *c) const
   {
     TRACE_SANITIZE (this);
-    return_trace (c->check_struct (this) && ((nRanges == 0) || (ranges[nRanges - 1]).sanitize (c)));
+    return_trace (ranges.sanitize (c));
   }
 
   hb_codepoint_t get_code (hb_codepoint_t glyph) const
   {
     assert (glyph > 0);
     glyph--;
-    for (unsigned int i = 0; i < nRanges; i++)
+    for (unsigned int i = 0; i < nRanges (); i++)
     {
       if (glyph <= ranges[i].nLeft)
       {
@@ -121,10 +117,12 @@
     return CFF_UNDEF_CODE;
   }
 
-  HBUINT8	   nRanges;
-  Encoding1_Range   ranges[VAR];
+  HBUINT8 &nRanges () { return ranges.len; }
+  HBUINT8 nRanges () const { return ranges.len; }
 
-  DEFINE_SIZE_ARRAY (1, ranges);
+  ArrayOf<Encoding1_Range, HBUINT8> ranges;
+
+  DEFINE_SIZE_ARRAY_SIZED (1, ranges);
 };
 
 struct SuppEncoding {
@@ -144,23 +142,22 @@
   bool sanitize (hb_sanitize_context_t *c) const
   {
     TRACE_SANITIZE (this);
-    return_trace (c->check_struct (this) && ((nSups == 0) || (supps[nSups - 1]).sanitize (c)));
+    return_trace (supps.sanitize (c));
   }
 
   void get_codes (hb_codepoint_t sid, hb_vector_t<hb_codepoint_t> &codes) const
   {
-    for (unsigned int i = 0; i < nSups; i++)
+    for (unsigned int i = 0; i < nSups (); i++)
       if (sid == supps[i].glyph)
 	codes.push (supps[i].code);
   }
 
-  unsigned int get_size () const
-  { return HBUINT8::static_size + SuppEncoding::static_size * nSups; }
+  HBUINT8 &nSups () { return supps.len; }
+  HBUINT8 nSups () const { return supps.len; }
 
-  HBUINT8	 nSups;
-  SuppEncoding   supps[VAR];
+  ArrayOf<SuppEncoding, HBUINT8> supps;
 
-  DEFINE_SIZE_ARRAY (1, supps);
+  DEFINE_SIZE_ARRAY_SIZED (1, supps);
 };
 
 struct Encoding {
@@ -204,7 +201,7 @@
     {
       Encoding0 *fmt0 = c->allocate_size<Encoding0> (Encoding0::min_size + HBUINT8::static_size * enc_count);
     if (unlikely (fmt0 == nullptr)) return_trace (false);
-      fmt0->nCodes.set (enc_count);
+      fmt0->nCodes ().set (enc_count);
       unsigned int glyph = 0;
       for (unsigned int i = 0; i < code_ranges.length; i++)
       {
@@ -219,7 +216,7 @@
     {
       Encoding1 *fmt1 = c->allocate_size<Encoding1> (Encoding1::min_size + Encoding1_Range::static_size * code_ranges.length);
       if (unlikely (fmt1 == nullptr)) return_trace (false);
-      fmt1->nRanges.set (code_ranges.length);
+      fmt1->nRanges ().set (code_ranges.length);
       for (unsigned int i = 0; i < code_ranges.length; i++)
       {
 	if (unlikely (!((code_ranges[i].code <= 0xFF) && (code_ranges[i].glyph <= 0xFF))))
@@ -232,7 +229,7 @@
     {
       CFF1SuppEncData *suppData = c->allocate_size<CFF1SuppEncData> (CFF1SuppEncData::min_size + SuppEncoding::static_size * supp_codes.length);
       if (unlikely (suppData == nullptr)) return_trace (false);
-      suppData->nSups.set (supp_codes.length);
+      suppData->nSups ().set (supp_codes.length);
       for (unsigned int i = 0; i < supp_codes.length; i++)
       {
 	suppData->supps[i].code.set (supp_codes[i].code);
@@ -291,9 +288,9 @@
   const CFF1SuppEncData &suppEncData () const
   {
     if ((format & 0x7F) == 0)
-      return StructAfter<CFF1SuppEncData> (u.format0.codes[u.format0.nCodes-1]);
+      return StructAfter<CFF1SuppEncData> (u.format0.codes[u.format0.nCodes ()-1]);
     else
-      return StructAfter<CFF1SuppEncData> (u.format1.ranges[u.format1.nRanges-1]);
+      return StructAfter<CFF1SuppEncData> (u.format1.ranges[u.format1.nRanges ()-1]);
   }
 
   public: