[cff] Thinkos in bias handling.

Only the final result is always positive.

Bug introduced three commits earlier.

* src/cff/cffgload.c, src/cff/cffgload.h: Apply.

ChangeLog

@@ -1,3 +1,13 @@
+2015-02-20  Werner Lemberg  <wl@gnu.org>
+
+	[cff] Thinkos in bias handling.
+
+	Only the final result is always positive.
+
+	Bug introduced three commits earlier.
+
+	* src/cff/cffgload.c, src/cff/cffgload.h: Apply.
+
 2015-02-20  Werner Lemberg  <wl@gnu.org>
 
 	[cid] Fix signedness issues and emit some better error codes.

src/cff/cffgload.c

@@ -337,7 +337,7 @@
   /*                                                                       */
   /* <Return>                                                              */
   /*    The bias value.                                                    */
-  static FT_UInt
+  static FT_Int
   cff_compute_bias( FT_Int   in_charstring_type,
                     FT_UInt  num_subrs )
   {
@@ -2385,7 +2385,8 @@
 
         case cff_op_callsubr:
           {
-            FT_UInt  idx = ( (FT_UInt)args[0] >> 16 ) + decoder->locals_bias;
+            FT_UInt  idx = (FT_UInt)( ( args[0] >> 16 ) +
+                                      decoder->locals_bias );
 
 
             FT_TRACE4(( " callsubr(%d)\n", idx ));
@@ -2426,7 +2427,8 @@
 
         case cff_op_callgsubr:
           {
-            FT_UInt  idx = ( (FT_UInt)args[0] >> 16 ) + decoder->globals_bias;
+            FT_UInt  idx = (FT_UInt)( ( args[0] >> 16 ) +
+                                      decoder->globals_bias );
 
 
             FT_TRACE4(( " callgsubr(%d)\n", idx ));

src/cff/cffgload.h

@@ -178,8 +178,8 @@ FT_BEGIN_HEADER
     FT_UInt            num_locals;
     FT_UInt            num_globals;
 
-    FT_UInt            locals_bias;
-    FT_UInt            globals_bias;
+    FT_Int             locals_bias;
+    FT_Int             globals_bias;
 
     FT_Byte**          locals;
     FT_Byte**          globals;