[gsub] Don't substitute in ReverseChainSingleSubstFormat1 if missing substitute

Fixes https://github.com/harfbuzz/harfbuzz/issues/2467

src/hb-ot-layout-gsub-table.hh

@@ -1205,6 +1205,8 @@ struct ReverseChainSingleSubstFormat1
     const OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage>> (backtrack);
     const ArrayOf<HBGlyphID> &substitute = StructAfter<ArrayOf<HBGlyphID>> (lookahead);
 
+    if (unlikely (index >= substitute.len)) return_trace (false);
+
     unsigned int start_index = 0, end_index = 0;
     if (match_backtrack (c,
 			 backtrack.len, (HBUINT16 *) backtrack.arrayZ,