[sfnt] Fix heap buffer overflow in CPAL handling. * src/sfnt/ttcpal.c (tt_face_palette_set): Fix boundary test. (tt_face_load_cpal): Updated.