Fix OOB in replace_glyph()

Patch from Kenichi Ishibashi.
diff --git a/src/hb-buffer.cc b/src/hb-buffer.cc
index 3e25b15..e8bdfb1 100644
--- a/src/hb-buffer.cc
+++ b/src/hb-buffer.cc
@@ -317,6 +317,8 @@
 void
 hb_buffer_t::replace_glyph (hb_codepoint_t glyph_index)
 {
+  if (!make_room_for (1, 1)) return;
+
   out_info[out_len] = info[idx];
   out_info[out_len].codepoint = glyph_index;