OSV-2018-146 Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11526 Crash type: Heap-buffer-overflow READ 1 Crash state: BEInt::operator unsigned short OT::KernSubTable::getsize void hbsanitizecontextt::setobjectOT::KernSubTableOT::KernOTSubTableHeader...