otvalid: Prevent an overflow by GPOS/GSUB 32b-bit offset.

ChangeLog

@@ -1,3 +1,14 @@
+2009-07-31  suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+
+	otvalid: Prevent an overflow by GPOS/GSUB 32b-bit offset.
+
+	* src/otvalid/otvgpos.c (otv_ExtensionPos_validate):
+	Extend ExtensionOffset from FT_UInt to FT_ULong, to
+	cover 32-bit offset on 16-bit platform.
+
+	* src/otvalid/otvgsub.c (otv_ExtensionSubst_validate):
+	Ditto.
+
 2009-07-31  suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
 
 	ftobjs.c: Prevent an overflow in glyph index handling.

src/otvalid/otvgpos.c

@@ -911,7 +911,8 @@
     {
     case 1:     /* ExtensionPosFormat1 */
       {
-        FT_UInt            ExtensionLookupType, ExtensionOffset;
+        FT_UInt            ExtensionLookupType;
+        FT_ULong           ExtensionOffset;
         OTV_Validate_Func  validate;
 
 

src/otvalid/otvgsub.c

@@ -415,7 +415,8 @@
     {
     case 1:     /* ExtensionSubstFormat1 */
       {
-        FT_UInt            ExtensionLookupType, ExtensionOffset;
+        FT_UInt            ExtensionLookupType;
+        FT_ULong           ExtensionOffset;
         OTV_Validate_Func  validate;