Fix uninit read in Android TrueType font scan

Problem reported privately by Michal Majchrowicz and Marcin
Wyczechowski, members of the AFINE Team.
* src/sfnt.c (sfnt_read_table_directory):
Fix typo where wrong size was used.

src/sfnt.c

@@ -263,7 +263,7 @@ sfnt_read_table_directory (int fd)
 
   rc = read (fd, subtable->subtables, subtable_size);
 
-  if (rc == -1 || rc < offset)
+  if (rc == -1 || rc < subtable_size)
     {
       xfree (subtable);
       return NULL;