font/sfnt: fix Font.GlyphBounds with truncated hmtx table

Thanks to Joe Blubaugh for the suggestion.

Change-Id: I27cb776614b5a4a0d023755f01b4db06e3d9a1c5
Reviewed-on: https://go-review.googlesource.com/c/image/+/244997
Run-TryBot: Nigel Tao <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Dmitri Shuralyov <[email protected]>
Reviewed-by: Nigel Tao <[email protected]>

 font/sfnt/sfnt.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/font/sfnt/sfnt.go b/font/sfnt/sfnt.go
index f05b4cd..d882891 100644
--- a/font/sfnt/sfnt.go
+++ b/font/sfnt/sfnt.go
@@ -1518,11 +1518,12 @@ func (f *Font) GlyphBounds(b *Buffer, x GlyphIndex, ppem fixed.Int26_6, h font.H
 	// optimization, the number of records can be less than the number of
 	// glyphs, in which case the advance width value of the last record applies
 	// to all remaining glyph IDs."
+	metricIndex := x
 	if n := GlyphIndex(f.cached.numHMetrics - 1); x > n {
-		x = n
+		metricIndex = n
 	}
 
-	buf, err := b.view(&f.src, int(f.hmtx.offset)+4*int(x), 2)
+	buf, err := b.view(&f.src, int(f.hmtx.offset)+4*int(metricIndex), 2)
 	if err != nil {
 		return fixed.Rectangle26_6{}, 0, err
 	}