We always read out of bounds here. Fix that.

src/sfnt/SkOTTable_name.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkOTTable_name.h"
 
 #include "SkEndian.h"
@@ skipping 50 matching lines @@
     0x00FF, 0x0178, 0x2044, 0x20AC, 0x2039, 0x203A, 0xFB01, 0xFB02,
     0x2021, 0x00B7, 0x201A, 0x201E, 0x2030, 0x00C2, 0x00CA, 0x00C1,
     0x00CB, 0x00C8, 0x00CD, 0x00CE, 0x00CF, 0x00CC, 0x00D3, 0x00D4,
     0xF8FF, 0x00D2, 0x00DA, 0x00DB, 0x00D9, 0x0131, 0x02C6, 0x02DC,
     0x00AF, 0x02D8, 0x02D9, 0x02DA, 0x00B8, 0x02DD, 0x02DB, 0x02C7,
 };
 
 static void SkStringFromMacRoman(const uint8_t* macRoman, size_t length, SkString& utf8) {
     utf8.reset();
     for (size_t i = 0; i < length; ++i) {
-        utf8.appendUnichar(macRoman[i] < 0x80 ? macRoman[i] : UnicodeFromMacRoman[macRoman[i]]);
+        utf8.appendUnichar(macRoman[i] < 0x80 ? macRoman[i]
+                                              : UnicodeFromMacRoman[macRoman[i] - 0x80]);
     }
 }
 
 static struct BCP47FromLanguageId {
     uint16_t languageID;
     const char* bcp47;
 }
 /** The Mac and Windows values do not conflict, so this is currently one single table. */
 BCP47FromLanguageID[] = {
     /** A mapping from Mac Language Designators to BCP 47 codes.
@@ skipping 443 matching lines @@
     if (languageIndex >= 0) {
         record.language = BCP47FromLanguageID[languageIndex].bcp47;
         return true;
     }
 
     // Unknown language, return the BCP 47 code 'und' for 'undetermined'.
     SkASSERT(false);
     record.language = "und";
     return true;
 }