[dos] Microsoft DirectWrite – Out-of-Bounds Read in sfac_GetSbitBitmap While Processing TTF Fonts