[PATCH 1/2] gdi32/uniscribe: Perform bounds check in GSUB_apply_MultipleSubst().