Fix offset verification in GDEF and GSUB header parsing.

src/gsub.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gsub.h"
 
 #include <limits>
 #include <vector>
 
 #include "gdef.h"
 #include "gpos.h"
 #include "layout.h"
 #include "maxp.h"
 
 // GSUB - The Glyph Substitution Table
 // http://www.microsoft.com/typography/otspec/gsub.htm
 
 namespace {
 
 // The GSUB header size
-const size_t kGsubHeaderSize = 8;
+const size_t kGsubHeaderSize = 4 + 3 * 2;
 
 enum GSUB_TYPE {
   GSUB_TYPE_SINGLE = 1,
   GSUB_TYPE_MULTIPLE = 2,
   GSUB_TYPE_ALTERNATE = 3,
   GSUB_TYPE_LIGATURE = 4,
   GSUB_TYPE_CONTEXT = 5,
   GSUB_TYPE_CHANGING_CONTEXT = 6,
   GSUB_TYPE_EXTENSION_SUBSTITUTION = 7,
   GSUB_TYPE_REVERSE_CHAINING_CONTEXT_SINGLE = 8,
@@ skipping 633 matching lines @@
 
   return true;
 }
 
 void ots_gsub_free(OpenTypeFile *file) {
   delete file->gsub;
 }
 
 }  // namespace ots