[type1] Avoid shift of negative numbers (#46732).

* src/type1/t1load.c (parse_subrs): Do it.

ChangeLog

@@ -1,3 +1,9 @@
+2015-12-21  Werner Lemberg  <wl@gnu.org>
+
+	[type1] Avoid shift of negative numbers (#46732).
+
+	* src/type1/t1load.c (parse_subrs): Do it.
+
 2015-12-20  Werner Lemberg  <wl@gnu.org>
 
 	[type1, psaux] Handle large values of num_subrs correctly (#46692).

src/type1/t1load.c

@@ -1433,7 +1433,8 @@
     }
 
     /* we certainly need more than 8 bytes per subroutine */
-    if ( num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
+    if ( parser->root.limit > parser->root.cursor                      &&
+         num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
     {
       /*
        * There are two possibilities.  Either the font contains an invalid