8219066: Fuzzing TrueType fonts: setCurrGlyphID()

Reviewed-by: andrew, mbalao
Contributed-by: NMartin Balao <mbalao@redhat.com>

src/share/native/sun/font/layout/ContextualSubstSubtables.cpp

@@ -67,7 +67,10 @@ void ContextualSubstitutionBase::applySubstitutionLookups(
         le_uint16 lookupListIndex = SWAPW(substLookupRecordArrayPtr[subst].lookupListIndex);
 
         tempIterator.setCurrStreamPosition(position);
-        tempIterator.next(sequenceIndex);
+        if (!tempIterator.next(sequenceIndex)) {
+            success = LE_INTERNAL_ERROR;
+            return;
+        }
 
         lookupProcessor->applySingleLookup(lookupListIndex, &tempIterator, fontInstance, success);
     }

src/share/native/sun/font/layout/GlyphIterator.cpp

@@ -224,6 +224,16 @@ void GlyphIterator::getCursiveExitPoint(LEPoint &exitPoint) const
 
 void GlyphIterator::setCurrGlyphID(TTGlyphID glyphID)
 {
+    if (direction < 0) {
+        if (position <= nextLimit || position >= prevLimit) {
+            return;
+        }
+    } else {
+        if (position <= prevLimit || position >= nextLimit) {
+            return;
+        }
+    }
+
     LEGlyphID glyph = glyphStorage[position];
 
     glyphStorage[position] = LE_SET_GLYPH(glyph, glyphID);

src/share/native/sun/font/layout/SubstitutionLookups.cpp

@@ -67,7 +67,10 @@ void SubstitutionLookup::applySubstitutionLookups(
         le_uint16 lookupListIndex = SWAPW(substLookupRecordArray[subst].lookupListIndex);
 
         tempIterator.setCurrStreamPosition(position);
-        tempIterator.next(sequenceIndex);
+        if (!tempIterator.next(sequenceIndex)) {
+            success = LE_INTERNAL_ERROR;
+            return;
+        }
 
         lookupProcessor->applySingleLookup(lookupListIndex, &tempIterator, fontInstance, success);
     }