fixed two bugs related to T2 real numbers: the "skipping" code didn't behave correctly (leaving a bad stack ptr), and the actual parsing code also parsed the code (30) as two nibbles.

src/cff/t2parse.c

@@ -153,7 +153,7 @@
                            FT_Byte*  limit,
                            FT_Int    power_ten )
   {
-    FT_Byte*  p    = start;
+    FT_Byte*  p    = ++start;
     FT_Long   num, divider, result, exp;
     FT_Int    sign = 0, exp_sign = 0;
     FT_Byte   nib;
@@ -472,6 +472,7 @@
         if ( v == 30 )
         {
           /* skip real number */
+          p++;
           for (;;)
           {
             if ( p >= limit )
@@ -484,7 +485,6 @@
               break;
             p++;
           }
-          p++;
         }
         else if ( v == 28 )
           p += 2;
@@ -526,7 +526,6 @@
             FT_Long   val;
             FT_Byte*  q = (FT_Byte*)parser->object + field->offset;
 
-
             switch ( field->kind )
             {
             case t2_kind_bool: