OSV-2021-1381 Heap-buffer-overflow in OT::MathValueRecord::copy

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39225 Crash type: Heap-buffer-overflow READ 4 Crash state: OT::MathValueRecord::copy OT::MathGlyphAssembly::subset OT::MathGlyphConstruction::subset...

OSV-2021-1370 Heap-buffer-overflow in OT::MathGlyphConstruction::subset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39211 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::MathGlyphConstruction::subset OT::MathVariants::subset OT::MATH::subset...