Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.

Source