[PATCH] sfnt2fon: Prevent reading past allocated buffer