[Bug 800595] CVE-2012-1137 freetype: heap buffer off-by-one in BDF parsing _bdf_list_ensure() (#35643)