Fix Savannah bug #36832. * src/type1/t1load.c (parse_charstrings): Reject negative number of glyphs.