[PATCH 4/5] dwrite: Fix offsets when stepping through chain rule fields.

[Nikolay Sivov]

Signed-off-by: Nikolay Sivov 
---
 dlls/dwrite/opentype.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/dlls/dwrite/opentype.c b/dlls/dwrite/opentype.c
index f1b9fb4e474..29f2a95a8c1 100644
--- a/dlls/dwrite/opentype.c
+++ b/dlls/dwrite/opentype.c
@@ -5180,10 +5180,12 @@ static BOOL opentype_layout_apply_chain_rule_set(const struct match_context *mc,
         backtrack = table_read_ensure(table, rule_offset, backtrack_count * sizeof(*backtrack));
         rule_offset += backtrack_count * sizeof(*backtrack);

-        input_count = table_read_be_word(table, rule_offset);
+        if (!(input_count = table_read_be_word(table, rule_offset)))
+            continue;
+
         rule_offset += 2;
-        input = table_read_ensure(table, rule_offset, input_count * sizeof(*input));
-        rule_offset += input_count * sizeof(*input);
+        input = table_read_ensure(table, rule_offset, (input_count - 1) * sizeof(*input));
+        rule_offset += (input_count - 1) * sizeof(*input);

lookahead_count = table_read_be_word(table, rule_offset);
         rule_offset += 2;