[repacker] fix heap use after free in repacker.

Don't store a reference to the link in overflow records as the link object may be freed if the sorted graph vector is resized.

src/hb-repacker.hh

diff --git a/src/hb-repacker.hh b/src/hb-repacker.hh
index b02128b..2370338 100644
--- a/src/hb-repacker.hh
+++ b/src/hb-repacker.hh
@@ -91,7 +91,7 @@
   struct overflow_record_t
   {
     unsigned parent;
-    const hb_serialize_context_t::object_t::link_t* link;
+    unsigned child;
   };
 
   struct clone_buffer_t
@@ -414,7 +414,7 @@
 
         overflow_record_t r;
         r.parent = parent_idx;
-        r.link = &link;
+        r.child = link.objidx;
         overflows->push (r);
       }
     }
@@ -430,10 +430,10 @@
     update_incoming_edge_count ();
     for (const auto& o : overflows)
     {
-      const auto& child = vertices_[o.link->objidx];
+      const auto& child = vertices_[o.child];
       DEBUG_MSG (SUBSET_REPACK, nullptr, "  overflow from %d => %d (%d incoming , %d outgoing)",
                  o.parent,
-                 o.link->objidx,
+                 o.child,
                  child.incoming_edges,
                  child.obj.links.length);
     }
@@ -708,12 +708,12 @@
     for (int i = overflows.length - 1; i >= 0; i--)
     {
       const graph_t::overflow_record_t& r = overflows[i];
-      const auto& child = sorted_graph.vertices_[r.link->objidx];
+      const auto& child = sorted_graph.vertices_[r.child];
       if (child.is_shared ())
       {
         // The child object is shared, we may be able to eliminate the overflow
         // by duplicating it.
-        sorted_graph.duplicate (r.parent, r.link->objidx);
+        sorted_graph.duplicate (r.parent, r.child);
         resolution_attempted = true;
 
         // Stop processing overflows for this round so that object order can be

test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5127321313476608

diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5127321313476608 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5127321313476608
new file mode 100644
index 0000000..476e251
--- /dev/null
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5127321313476608
Binary files differ