fix stack overflow in create_norm_table on crafted .cmap

[arshsmith1]

create_norm_table sizes the stack array d from the file's N count, but the fill loop stops on the terminating "." line rather than that count, so a charset .cmap that declares a small N followed by more entry lines runs cur past the end of d. The existing sanity(cur - d == size) only runs after the loop, too late to help. Any dictionary whose charset has a matching .cmap loads this during normalization, so a crafted data file gives a stack out-of-bounds write of attacker-controlled data.

Reproduced with a .cmap declaring "N 1" then 300 "XXXX > YY" lines; ASan reports dynamic-stack-buffer-overflow (WRITE) at convert.cpp in the cur->from assignment. Bounding the loop with the same sanity() the function already uses rejects the over-long table as bad input, and valid .cmap files still load unchanged.