[sfnt] Fix infinite loops with broken cmaps (#46167).

* src/sfnt/ttcmap.c (tt_cmap8_char_next, tt_cmap12_next): Take care
of border condidions (i.e., if the loops exit naturally).

ChangeLog

@@ -1,3 +1,10 @@
+2015-10-10  Werner Lemberg  <wl@gnu.org>
+
+	[sfnt] Fix infinite loops with broken cmaps (#46167).
+
+	* src/sfnt/ttcmap.c (tt_cmap8_char_next, tt_cmap12_next): Take care
+	of border condidions (i.e., if the loops exit naturally).
+
 2015-10-10  Werner Lemberg  <wl@gnu.org>
 
 	[truetype] More sanity tests for GX handling.

src/sfnt/ttcmap.c

@@ -1891,7 +1891,10 @@
         /* if `gindex' is invalid, the remaining values */
         /* in this group are invalid, too               */
         if ( gindex >= (FT_UInt)face->num_glyphs )
+        {
+          gindex = 0;
           continue;
+        }
 
         result = char_code;
         break;
@@ -2277,7 +2280,10 @@
         /* if `gindex' is invalid, the remaining values */
         /* in this group are invalid, too               */
         if ( gindex >= (FT_UInt)face->num_glyphs )
+        {
+          gindex = 0;
           continue;
+        }
 
         cmap->cur_charcode = char_code;
         cmap->cur_gindex   = gindex;