[Harfbuzz] Fix OOB read in tibetan_form()

third_party/harfbuzz/src/harfbuzz-tibetan.c

 /*
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This is part of HarfBuzz, an OpenType Layout engine library.
  *
  * Permission is hereby granted, without written agreement and without
  * license or royalty fees, to use, copy, modify, and distribute this
  * software and its documentation for any purpose, provided that the
  * above copyright notice and the following two paragraphs appear in
  * all copies of this software.
@@ skipping 72 matching lines @@
     TibetanSubjoinedConsonant, TibetanSubjoinedConsonant, TibetanSubjoinedConsonant, TibetanSubjoinedConsonant,
 
     TibetanSubjoinedConsonant, TibetanSubjoinedConsonant, TibetanSubjoinedConsonant, TibetanSubjoinedConsonant,
     TibetanSubjoinedConsonant, TibetanSubjoinedConsonant, TibetanSubjoinedConsonant, TibetanSubjoinedConsonant,
     TibetanSubjoinedConsonant, TibetanSubjoinedConsonant, TibetanSubjoinedConsonant, TibetanSubjoinedConsonant,
     TibetanSubjoinedConsonant, TibetanOther, TibetanOther, TibetanOther
 };
 
 
 #define tibetan_form(c) \
-    ((c) >= 0x0f40 && (c) <= 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
+    ((c) >= 0x0f40 && (c) < 0x0fc0 ? (TibetanForm)tibetanForm[(c) - 0x0f40] : TibetanOther)
 
 static const HB_OpenTypeFeature tibetan_features[] = {
     { HB_MAKE_TAG('c', 'c', 'm', 'p'), CcmpProperty },
     { HB_MAKE_TAG('a', 'b', 'v', 's'), AboveSubstProperty },
     { HB_MAKE_TAG('b', 'l', 'w', 's'), BelowSubstProperty },
     { HB_MAKE_TAG('c', 'a', 'l', 't'), CaltProperty },
     {0, 0}
 };
 
 static HB_Bool tibetan_shape_syllable(HB_Bool openType, HB_ShaperItem *item, HB_Bool invalid)
@@ skipping 161 matching lines @@
         while (i < boundary) {
             attributes[i].charStop = FALSE;
             ++uc;
             ++i;
         }
         assert(i == boundary);
     }
 }