Nikolay Sivov : dwrite: Fix offsets when stepping through chain rule fields.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: db6c4156afed774585d36b68a513565c9c52952a
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=db6c4156afed774585d36b68a513565c9c52952a

Author: Nikolay Sivov <nsivov at codeweavers.com>
Date:   Mon Jun  1 12:23:36 2020 +0300

dwrite: Fix offsets when stepping through chain rule fields.

Signed-off-by: Nikolay Sivov <nsivov at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 dlls/dwrite/opentype.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/dlls/dwrite/opentype.c b/dlls/dwrite/opentype.c
index f1b9fb4e47..29f2a95a8c 100644
--- a/dlls/dwrite/opentype.c
+++ b/dlls/dwrite/opentype.c
@@ -5180,10 +5180,12 @@ static BOOL opentype_layout_apply_chain_rule_set(const struct match_context *mc,
         backtrack = table_read_ensure(table, rule_offset, backtrack_count * sizeof(*backtrack));
         rule_offset += backtrack_count * sizeof(*backtrack);
 
-        input_count = table_read_be_word(table, rule_offset);
+        if (!(input_count = table_read_be_word(table, rule_offset)))
+            continue;
+
         rule_offset += 2;
-        input = table_read_ensure(table, rule_offset, input_count * sizeof(*input));
-        rule_offset += input_count * sizeof(*input);
+        input = table_read_ensure(table, rule_offset, (input_count - 1) * sizeof(*input));
+        rule_offset += (input_count - 1) * sizeof(*input);
 
         lookahead_count = table_read_be_word(table, rule_offset);
         rule_offset += 2;