[Bug 1191079] CVE-2014-9657 freetype: off-by-one buffer over-read in tt_face_load_hdmx()