[gxvalid] Fix a bug to detect too large offset in morx table.

* src/gxvalid/gxvmorx2.c
(gxv_morx_subtable_type2_ligActionIndex_validate): Fix a bug
that too large positive offset cannot be detected.

ChangeLog

@@ -1,3 +1,11 @@
+2011-10-07  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
+
+	[gxvalid] Fix a bug to detect too large offset in morx table.
+
+	* src/gxvalid/gxvmorx2.c
+	(gxv_morx_subtable_type2_ligActionIndex_validate): Fix a bug
+	that too large positive offset cannot be detected.
+
 2011-10-01  Braden Thomas  <bthomas@apple.com>
 
 	Handle some border cases.

src/gxvalid/gxvmorx2.c

@@ -173,6 +173,7 @@
       FT_UShort  store;
 #endif
       FT_ULong   offset;
+      FT_Long    gid_limit;
 
 
       lig_action = FT_NEXT_ULONG( p );
@@ -186,8 +187,9 @@
       /* this offset is 30-bit signed value to add to GID */
       /* it is different from the location offset in mort */
       if ( ( offset & 0x3FFF0000UL ) == 0x3FFF0000UL )
-      {
-        if ( offset + valid->face->num_glyphs > 0x40000000UL )
+      { /* negative offset */
+        gid_limit = valid->face->num_glyphs - ( offset & 0x0000FFFFUL );
+        if ( gid_limit > 0 )
           return;
 
         GXV_TRACE(( "ligature action table includes"
@@ -197,8 +199,8 @@
         GXV_SET_ERR_IF_PARANOID( FT_INVALID_OFFSET );
       }
       else if ( ( offset & 0x3FFF0000UL ) == 0x0000000UL )
-      {
-        if ( offset + valid->face->num_glyphs < 0 )
+      { /* positive offset */
+        if ( (FT_Long)offset < valid->face->num_glyphs )
           return;
 
         GXV_TRACE(( "ligature action table includes"