[subset] Enforce cmap12 group ordering constraints in collect_mapping.

Fixes fuzzer issue: https://oss-fuzz.com/testcase-detail/6365271012540416

src/hb-ot-cmap-table.hh

diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh
index d050b2f..ed867b7 100644
--- a/src/hb-ot-cmap-table.hh
+++ b/src/hb-ot-cmap-table.hh
@@ -738,11 +738,19 @@
 			hb_map_t *mapping, /* OUT */
 			unsigned num_glyphs) const
   {
+    hb_codepoint_t last_end = 0;
     for (unsigned i = 0; i < this->groups.len; i++)
     {
       hb_codepoint_t start = this->groups[i].startCharCode;
       hb_codepoint_t end = hb_min ((hb_codepoint_t) this->groups[i].endCharCode,
 				   (hb_codepoint_t) HB_UNICODE_MAX);
+      if (unlikely (start > end || start < last_end)) {
+        // Range is not in order and is invalid, skip it.
+        continue;
+      }
+      last_end = end;
+
+
       hb_codepoint_t gid = this->groups[i].glyphID;
       if (!gid)
       {

test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6365271012540416

diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6365271012540416 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6365271012540416
new file mode 100644
index 0000000..6da6a1c
--- /dev/null
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-6365271012540416
Binary files differ