diff --git a/src/w32uniscribe.c b/src/w32uniscribe.c
index 2641aead054c1d6f5018e00fd2e9225923fa0d76..62734d05cde3dd339feb42bc3f7ebd4cad84d45f 100644
--- a/src/w32uniscribe.c
+++ b/src/w32uniscribe.c
@@ -563,6 +563,7 @@ int uniscribe_check_otf (font, otf_spec)
   HFONT check_font, old_font;
   DWORD table;
   int i, retval = 0;
+  struct gcpro gcpro1;
 
   /* Check the spec is in the right format.  */
   if (!CONSP (otf_spec) || Flength (otf_spec) < 3)
@@ -599,6 +600,10 @@ int uniscribe_check_otf (font, otf_spec)
   check_font = CreateFontIndirect (font);
   old_font = SelectObject (context, check_font);
 
+  /* Everything else is contained within otf_spec so should get
+     marked along with it.  */
+  GCPRO1 (otf_spec);
+
   /* Scan GSUB and GPOS tables.  */
   for (i = 0; i < 2; i++)
     {
@@ -676,7 +681,7 @@ int uniscribe_check_otf (font, otf_spec)
 	 documentation in font_prop_validate_otf, so count them.  */
       n_match_features = 0;
       rest = features[i];
-      for (feature = XCAR (rest); CONSP (rest); feature = XCAR (rest))
+      for (feature = XCAR (rest); CONSP (rest); feature = CAR_SAFE (rest))
 	{
 	  rest = XCDR (rest);
 	  if (!NILP (feature))