Fix another move_to assertion failure

If buf->idx is at end, don't set end past it...

Fixes https://github.com/behdad/harfbuzz/issues/173

src/hb-ot-layout-gsubgpos-private.hh

@@ -988,7 +988,7 @@ static inline bool apply_lookup (hb_apply_context_t *c,
     /* end can't go back past the current match position.
      * Note: this is only true because we do NOT allow MultipleSubst
      * with zero sequence len. */
-    end = MAX ((int) match_positions[idx] + 1, int (end) + delta);
+    end = MAX (MIN((int) match_positions[idx] + 1, (int) new_len), int (end) + delta);
 
     unsigned int next = idx + 1; /* next now is the position after the recursed lookup. */