[PATCH v3 1/1] gdi32/uniscribe: Perform bounds check in GSUB_apply_MultipleSubst().