When loading in Load_Chain{Sub,Pos}ClassRule, the limit we have only

Tue Apr 15 11:49:39 2003  Owen Taylor  <otaylor@redhat.com>

        * pango/opentype/ftxg{sub/pos}.c: When loading
        in Load_Chain{Sub,Pos}ClassRule, the limit we
        have only applies to the input ClassDef table.
        Fixes problem with Arial Unicode. Much help from
        Noah Levitt in tracing this down.

src/ftxgpos.c

@@ -4827,13 +4827,14 @@
     lookahead_offset = GET_UShort();
 
     /* `ChainPosClassSetCount' is the upper limit for input class values,
-       thus we read it now to make an additional safety check.            */
+       thus we read it now to make an additional safety check. No limit
+       is known or needed for the other two class definitions          */
 
     count = ccpf2->ChainPosClassSetCount = GET_UShort();
 
     FORGET_Frame();
 
-    if ( ( error = Load_EmptyOrClassDefinition( &ccpf2->BacktrackClassDef, count,
+    if ( ( error = Load_EmptyOrClassDefinition( &ccpf2->BacktrackClassDef, 65535,
 						backtrack_offset, base_offset,
 						stream ) ) != TT_Err_Ok )
       goto Fail5;
@@ -4841,7 +4842,7 @@
 						input_offset, base_offset,
 						stream ) ) != TT_Err_Ok )
       goto Fail4;
-    if ( ( error = Load_EmptyOrClassDefinition( &ccpf2->LookaheadClassDef, count,
+    if ( ( error = Load_EmptyOrClassDefinition( &ccpf2->LookaheadClassDef, 65535,
 						lookahead_offset, base_offset,
 						stream ) ) != TT_Err_Ok )
       goto Fail3;

src/ftxgsub.c

@@ -2994,13 +2994,14 @@
     lookahead_offset = GET_UShort();
 
     /* `ChainSubClassSetCount' is the upper limit for input class values,
-       thus we read it now to make an additional safety check.            */
+       thus we read it now to make an additional safety check. No limit
+       is known or needed for the other two class definitions          */
 
     count = ccsf2->ChainSubClassSetCount = GET_UShort();
 
     FORGET_Frame();
 
-    if ( ( error = Load_EmptyOrClassDefinition( &ccsf2->BacktrackClassDef, count,
+    if ( ( error = Load_EmptyOrClassDefinition( &ccsf2->BacktrackClassDef, 65535,
                                                 backtrack_offset, base_offset,
 					        stream ) ) != TT_Err_Ok )
         goto Fail5;
@@ -3009,7 +3010,7 @@
                                                 input_offset, base_offset,
                                                 stream ) ) != TT_Err_Ok )
         goto Fail4;
-    if ( ( error = Load_EmptyOrClassDefinition( &ccsf2->LookaheadClassDef, count,
+    if ( ( error = Load_EmptyOrClassDefinition( &ccsf2->LookaheadClassDef, 65535,
                                                 lookahead_offset, base_offset,
                                                 stream ) ) != TT_Err_Ok )
       goto Fail3;