diff --git a/src/scratchpad/src/org/apache/poi/hemf/record/emf/HemfFont.java b/src/scratchpad/src/org/apache/poi/hemf/record/emf/HemfFont.java
index b95f83c3cf..c7f189f1d5 100644
--- a/src/scratchpad/src/org/apache/poi/hemf/record/emf/HemfFont.java
+++ b/src/scratchpad/src/org/apache/poi/hemf/record/emf/HemfFont.java
@@ -461,17 +461,17 @@ public class HemfFont extends HwmfFont {
             // A 32-bit unsigned integer that specifies the number of elements in the
             // Values array. It MUST be in the range 0 to 16, inclusive.
             int numAxes = leis.readInt();
-            assert (0 <= numAxes && numAxes <= 16);
+            size += 2*LittleEndianConsts.INT_SIZE;
 
             // An optional array of 32-bit signed integers that specify the values of the font axes of a
             // multiple master, OpenType font. The maximum number of values in the array is 16.
-            if (numAxes > 0) {
+            if (0 <= numAxes && numAxes <= 16) {
                 logEx.designVector = new int[numAxes];
                 for (int i=0; i<numAxes; i++) {
                     logEx.designVector[i] = leis.readInt();
                 }
+                size += numAxes*LittleEndianConsts.INT_SIZE;
             }
-            size += (2+numAxes)*LittleEndianConsts.INT_SIZE;
         }
 
         return size;
@@ -532,9 +532,9 @@ public class HemfFont extends HwmfFont {
             b1 = buf[readBytes++];
             b2 = buf[readBytes++];
         } while ((b1 != 0 || b2 != 0) && b1 != -1 && b2 != -1 && readBytes <= limit*2);
-
         sb.append(new String(buf, 0, readBytes-2, StandardCharsets.UTF_16LE));
 
         return limit*2;
     }
 }
+
diff --git a/src/scratchpad/src/org/apache/poi/hemf/record/emf/HemfRecordIterator.java b/src/scratchpad/src/org/apache/poi/hemf/record/emf/HemfRecordIterator.java
index bbe930f4ac..afdcaa533f 100644
--- a/src/scratchpad/src/org/apache/poi/hemf/record/emf/HemfRecordIterator.java
+++ b/src/scratchpad/src/org/apache/poi/hemf/record/emf/HemfRecordIterator.java
@@ -78,7 +78,9 @@ public class HemfRecordIterator implements Iterator<HemfRecord> {
         try {
             long remBytes = recordSize - HEADER_SIZE;
             long readBytes = record.init(stream, remBytes, recordId);
-            assert (readBytes <= remBytes);
+            if (readBytes > remBytes) {
+                throw new RecordFormatException("Record limit exceeded - readBytes: "+readBytes+" / remBytes: "+remBytes);
+            }
             stream.skipFully((int) (remBytes - readBytes));
         } catch (RecordFormatException e) {
             throw e;