Fix handling of `dup' CFF instruction. Problem and solution reported by Ning Dong <flintning@163.com>. * src/cff/cffgload.c (cff_decoder_parse_charstrings) <cff_op_dup>: Increase `args' by 2, not 1.