Fix unbounded ReadGlyph allocation (issue #191)

[parasol-aser]

Summary

Fixes #191: ReadGlyph can allocate an oversized contour when a malformed simple glyph has non-monotonic endPtsOfContours values. The subtraction that computes num_points can wrap before std::vector<Glyph::Point>::resize.

Fix

src/glyph.cc now rejects simple glyphs where a later endPtsOfContours entry is smaller than the previous entry:

if (i > 0 && point_index < last_point_index) {
  return FONT_COMPRESSION_FAILURE();
}

This is the spec-level invariant needed for the reported allocation bug. I removed the earlier remaining-byte cap because it was based on a wrong assumption: simple-glyph flags are RLE-encoded, so logical point count is not bounded by one stored flag byte per point. StoreEndPtsOfContours also confirms that the endpoint value itself may reach uint16_t::max().

Changes

• src/glyph.cc — reject decreasing endPtsOfContours before computing num_points.
• src/convert_ttf2woff2_fuzzer.cc — add an encoder fuzz entry point.
• CMakeLists.txt — register the encoder fuzzer and opt-in regression tests.
• test/test_read_glyph.cc — cover non-monotonic endpoints and RLE-encoded flags.
• test/test_convert_ttf2woff2.cc / test/generate_fixtures.py — cover valid baseline input and malformed non-monotonic TTF fixtures.

Test plan

• cmake -S . -B build -G Ninja
• cmake --build build
• ctest --test-dir build --output-on-failure
• ./build/test_read_glyph

Reviewer follow-up still useful: run a longer encoder fuzzing session against a normal sfnt corpus and compare woff2_compress output on a known-good corpus.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.