Detailed report: https://clusterfuzz.com/testcase?key=5744940099043328

Fuzzer: libFuzzer_sfntly_fuzzer
Fuzz target binary: sfntly_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  sfntly::BitmapGlyph::Builder::SubDataSizeToSerialize
  sfntly::EbdtTable::Builder::GenerateLocaList
  sfntly::SetupBitmapBuilders
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=537679:537681

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5744940099043328

Issue filed automatically.

See https://www.chromium.org/developers/testing/memorysanitizer#TOC-Reproducing-ClusterFuzz-Bugs for instructions to reproduce this bug locally.