[truetype] Fix HVAR and VVAR handling (#50678).

* src/truetype/ttgxvar.c (tt_hvadvance_adjust): Handle
glyph indices larger than `mapCount' as described in the
specification.

ChangeLog

@@ -1,3 +1,11 @@
+2017-03-30  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Fix HVAR and VVAR handling (#50678).
+
+	* src/truetype/ttgxvar.c (tt_hvadvance_adjust): Handle
+	glyph indices larger than `mapCount' as described in the
+	specification.
+
 2017-03-30  Werner Lemberg  <wl@gnu.org>
 
 	[truetype] Allow linear scaling for unhinted rendering (#50470).

src/truetype/ttgxvar.c

@@ -1007,16 +1007,15 @@
 
     if ( table->widthMap.innerIndex )
     {
-      if ( gindex >= table->widthMap.mapCount )
-      {
-        FT_TRACE2(( "gindex %d out of range\n", gindex ));
-        error = FT_THROW( Invalid_Argument );
-        goto Exit;
-      }
+      FT_UInt  idx = gindex;
+
+
+      if ( idx >= table->widthMap.mapCount )
+        idx = table->widthMap.mapCount - 1;
 
       /* trust that HVAR parser has checked indices */
-      outerIndex = table->widthMap.outerIndex[gindex];
-      innerIndex = table->widthMap.innerIndex[gindex];
+      outerIndex = table->widthMap.outerIndex[idx];
+      innerIndex = table->widthMap.innerIndex[idx];
     }
     else
     {