Apply patch #7196. * src/cff/cffgload.c (cff_slot_load): Prevent crash if CFF subfont index is out of range.