SVGLength: Avoid reading out-of-bounds when parsing incorrect 'rem' unit

Source/core/svg/SVGLength.cpp

Index: Source/core/svg/SVGLength.cpp
diff --git a/Source/core/svg/SVGLength.cpp b/Source/core/svg/SVGLength.cpp
index 1c37407b3be6f355b4f2c65a2cbe972992ca76fb..7b37c161fd9f5d31a7893774fd9767157be1d57c 100644
--- a/Source/core/svg/SVGLength.cpp
+++ b/Source/core/svg/SVGLength.cpp
@@ -98,7 +98,7 @@ SVGLengthType stringToLengthType(const CharType*& ptr, const CharType* end)
             if (secondChar == 'x')
                 type = LengthTypeEXS;
         } else if (firstChar == 'r') {
-            if (secondChar == 'e') {
+            if (secondChar == 'e' && ptr < end) {
                 const CharType thirdChar = *ptr++;
                 if (thirdChar == 'm')
                     type = LengthTypeREMS;