Cherry pick the following two CLs from upstream

[sfnt] Guard individual `COLR` v1 paint field reads.

* src/sfnt/ttcolr.c (ENSURE_READ_BYTES): New macro.
(read_paint): Use it – after the start pointer `p` has been checked for
whether it allows reading the format byte, each successive paint table field
read need to be bounds-checked before reading further values.

Reported as

[sfnt] Additional bounds checks for `COLR` v1 table handling.

* src/sfnt/ttcolr.c (read_paint): Add `colr` argument, necessary for...
... another use of `ENSURE_READ_BYTES`.
Update callers.
(tt_face_get_paint_layers): Ensure that the 4-byte paint table
offset can be read.

This is a follow-up to !124 and issue

Bug: 254803162
Test: m libft2
Test: atest CtsTextTestCases
Test: atest CtsGraphicsTestCases
Change-Id: I2b60b477495b444fa64722a9a78586839f25c3d9
Merged-In: Ic17ae69c9ee4877acb0bc667541c78b967da46a9
1 file changed