heap out-of-bounds read in pale moon cpal parser

a missing bound check in pale moon CPAL validation lets a web font read past its heap allocation and leak the bytes through canvas pixels