[Bug 1191090] CVE-2014-9667 freetype: integer overflow and out-of-bounds read in sfnt/ttload.c