[kern] Fix access violation in Format3

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11245

src/hb-ot-kern-table.hh

@@ -417,7 +417,11 @@ struct KernSubTableFormat3
     hb_array_t<const HBUINT8> rightClass = StructAfter<const UnsizedArrayOf<HBUINT8> > (leftClass).as_array (glyphCount);
     hb_array_t<const HBUINT8> kernIndex = StructAfter<const UnsizedArrayOf<HBUINT8> > (rightClass).as_array (leftClassCount * rightClassCount);
 
-    unsigned int i = leftClass[left] * rightClassCount + rightClass[right];
+    unsigned int leftC = leftClass[left];
+    unsigned int rightC = rightClass[right];
+    if (unlikely (leftC >= leftClassCount || rightC >= rightClassCount))
+      return 0;
+    unsigned int i = leftC * rightClassCount + rightC;
     return kernValue[kernIndex[i]];
   }