[PATCH v7 3/4] gdi32/uniscribe: Perform bounds check in GSUB_apply_MultipleSubst().