diff -u freetype-2.6.3/debian/changelog freetype-2.6.3/debian/changelog
--- freetype-2.6.3/debian/changelog
+++ freetype-2.6.3/debian/changelog
@@ -1,3 +1,11 @@
+freetype (2.6.3-3.2+deb9u1) stretch; urgency=medium
+
+  * Add an upstream patch to correctly handle deltas in TrueType GX fonts
+    (Closes: 929982). This patch will allow variable hinted fonts to render
+    correctly in Chromium and Firefox.
+
+ -- Hugh McMaster <hugh.mcmaster@outlook.com>  Sun, 28 Jul 2019 19:35:12 +1000
+
 freetype (2.6.3-3.2) unstable; urgency=high
 
   * Non-maintainer upload.
diff -u freetype-2.6.3/debian/patches-freetype/series freetype-2.6.3/debian/patches-freetype/series
--- freetype-2.6.3/debian/patches-freetype/series
+++ freetype-2.6.3/debian/patches-freetype/series
@@ -1,3 +1,4 @@
+fix-GX-delta-handling.patch
 no-uninitialized-bbox.patch
 freetype-2.1.7-backwards.compat.patch -p0
 enable-subpixel-rendering.patch
--- freetype-2.6.3.orig/debian/patches-freetype/fix-GX-delta-handling.patch
+++ freetype-2.6.3/debian/patches-freetype/fix-GX-delta-handling.patch
@@ -0,0 +1,54 @@
+Description: Fix handling of deltas in TrueType GX fonts
+ FreeType versions 2.6.2 to 2.6.5 incorrectly handle deltas in TrueType GX fonts.
+  - Correctly handle the sanity test for glyph variation array header size.
+  - Always set stream position before reading packed x and y deltas.
+Author: Werner Lemberg <wl@gnu.org>
+Bug-Debian: https://bugs.debian.org/929982
+Forwarded: not-needed
+
+Index: freetype-2.6.3/src/truetype/ttgxvar.c
+===================================================================
+--- freetype-2.6.3.orig/src/truetype/ttgxvar.c
++++ freetype-2.6.3/src/truetype/ttgxvar.c
+@@ -1877,7 +1877,8 @@
+     offsetToData = FT_GET_USHORT();
+ 
+     /* rough sanity test */
+-    if ( offsetToData + tupleCount * 4 > blend->gvar_size )
++    if ( offsetToData + ( tupleCount & GX_TC_TUPLE_COUNT_MASK ) * 4 >
++           blend->gvar_size )
+     {
+       FT_TRACE2(( "TT_Vary_Apply_Glyph_Deltas:"
+                   " invalid glyph variation array header\n" ));
+@@ -1959,10 +1960,10 @@
+ 
+       here = FT_Stream_FTell( stream );
+ 
++      FT_Stream_SeekSet( stream, offsetToData );
++
+       if ( tupleIndex & GX_TI_PRIVATE_POINT_NUMBERS )
+       {
+-        FT_Stream_SeekSet( stream, offsetToData );
+-
+         localpoints = ft_var_readpackedpoints( stream,
+                                                blend->gvar_size,
+                                                &point_count );
+@@ -2027,9 +2028,6 @@
+ #endif
+       }
+ 
+-      else if ( localpoints == NULL )
+-        ; /* failure, ignore it */
+-
+       else
+       {
+ #ifdef FT_DEBUG_LEVEL_TRACE
+@@ -2047,7 +2045,7 @@
+ 
+         for ( j = 0; j < point_count; j++ )
+         {
+-          FT_UShort  idx = localpoints[j];
++          FT_UShort  idx = points[j];
+ 
+ 
+           if ( idx >= n_points )