Fix offset verification in GDEF and GSUB header parsing.

src/gdef.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gdef.h"
 
 #include <limits>
 #include <vector>
 
 #include "gpos.h"
@@ skipping 272 matching lines @@
       !table.ReadU16(&offset_mark_attach_class_def)) {
     return OTS_FAILURE();
   }
   uint16_t offset_mark_glyph_sets_def = 0;
   if (gdef->version_2) {
     if (!table.ReadU16(&offset_mark_glyph_sets_def)) {
       return OTS_FAILURE();
     }
   }
 
-  unsigned gdef_header_end = 8;
+  unsigned gdef_header_end = 4 + 4 * 2;
   if (gdef->version_2)
     gdef_header_end += 2;
 
   // Parse subtables
   if (offset_glyph_class_def) {
     if (offset_glyph_class_def >= length ||
         offset_glyph_class_def < gdef_header_end) {
       return OTS_FAILURE();
     }
     if (!ParseGlyphClassDefTable(file, data + offset_glyph_class_def,
@@ skipping 80 matching lines @@
 
   return true;
 }
 
 void ots_gdef_free(OpenTypeFile *file) {
   delete file->gdef;
 }
 
 }  // namespace ots