OSV-2018-97 Heap-buffer-overflow in CFF::CFF2VariationStore::serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11713 Crash type: Heap-buffer-overflow READ Crash state: CFF::CFF2VariationStore::serialize writecff2 hbsubsetcff2...