font/sfnt: fix uint16 overflow in Glyph{Advance,Index}

This CL builds on top of the patch provided by user @dejadejade.

Fixes golang/go#39577.

Change-Id: I6db1561df1c659b8b1678eb96522f406e6a5799b
Reviewed-on: https://go-review.googlesource.com/c/image/+/237900
Reviewed-by: Nigel Tao <nigeltao@golang.org>

 font/sfnt/sfnt.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/font/sfnt/sfnt.go b/font/sfnt/sfnt.go
index b6045e7..f05b4cd 100644
--- a/font/sfnt/sfnt.go
+++ b/font/sfnt/sfnt.go
@@ -1522,7 +1522,7 @@ func (f *Font) GlyphBounds(b *Buffer, x GlyphIndex, ppem fixed.Int26_6, h font.H
 		x = n
 	}
 
-	buf, err := b.view(&f.src, int(f.hmtx.offset)+int(4*x), 2)
+	buf, err := b.view(&f.src, int(f.hmtx.offset)+4*int(x), 2)
 	if err != nil {
 		return fixed.Rectangle26_6{}, 0, err
 	}
@@ -1602,7 +1602,7 @@ func (f *Font) GlyphAdvance(b *Buffer, x GlyphIndex, ppem fixed.Int26_6, h font.
 		x = n
 	}
 
-	buf, err := b.view(&f.src, int(f.hmtx.offset)+int(4*x), 2)
+	buf, err := b.view(&f.src, int(f.hmtx.offset)+4*int(x), 2)
 	if err != nil {
 		return 0, err
 	}