[truetype] Fix loading of named instances.

* src/truetype/ttgxvar.c (TT_Get_MM_Var): Preserve file position
while loading the `avar' table.

ChangeLog

@@ -1,3 +1,10 @@
+2017-08-01  Behdad Esfahbod  <behdad@behdad.org>
+
+	[truetype] Fix loading of named instances.
+
+	* src/truetype/ttgxvar.c (TT_Get_MM_Var): Preserve file position
+	while loading the `avar' table.
+
 2017-08-01  Werner Lemberg  <wl@gnu.org>
 
 	[sfnt, truetype] Minor adjustments for OpenType 1.8.2.

include/freetype/ftmm.h

@@ -178,7 +178,7 @@ FT_BEGIN_HEADER
   /*    strid  :: The entry in `name' table identifying this instance.     */
   /*                                                                       */
   /*    psid   :: The entry in `name' table identifying a PostScript name  */
-  /*              for this instance.                                       */
+  /*              for this instance.  Value 0 indicates a missing entry.   */
   /*                                                                       */
   typedef struct  FT_Var_Named_Style_
   {

src/truetype/ttgxvar.c

@@ -2139,8 +2139,16 @@
         goto Exit;
 
       if ( fvar_head.instanceCount && !face->blend->avar_loaded )
+      {
+        FT_ULong  offset = FT_STREAM_POS();
+
+
         ft_var_load_avar( face );
 
+        if ( FT_STREAM_SEEK( offset ) )
+          goto Exit;
+      }
+
       ns  = mmvar->namedstyle;
       nsc = face->blend->normalized_stylecoords;
       for ( i = 0; i < fvar_head.instanceCount; i++, ns++ )
@@ -2157,6 +2165,7 @@
         for ( j = 0; j < fvar_head.axisCount; j++, c++ )
           *c = FT_GET_LONG();
 
+        /* valid psid values are 6 and [256;32767] */
         if ( usePsName )
           ns->psid = FT_GET_USHORT();
 
@@ -2174,7 +2183,7 @@
         SFNT_Service  sfnt = (SFNT_Service)face->sfnt;
 
         FT_Int   found, dummy1, dummy2;
-        FT_UInt  strid = 0xFFFFFFFFUL;
+        FT_UInt  strid = ~0U;
 
 
         /* the default instance is missing in array the   */