[PATCH v4 0/3] MR10844: gdi32/uniscribe: Perform bounds check in GSUB_apply_MultipleSubst().