[GPOS] Fix div-by-zero

Patch by Jonathan Kew.  Mozilla bug #465728.

src/hb-ot-layout-gpos-private.hh

@@ -345,7 +345,7 @@ struct AnchorMatrix
   inline bool sanitize (hb_sanitize_context_t *c, unsigned int cols) {
     TRACE_SANITIZE ();
     if (!c->check_struct (this)) return false;
-    if (unlikely (cols >= ((unsigned int) -1) / rows)) return false;
+    if (unlikely (rows > 0 && cols >= ((unsigned int) -1) / rows)) return false;
     unsigned int count = rows * cols;
     if (!c->check_array (matrix, matrix[0].static_size, count)) return false;
     for (unsigned int i = 0; i < count; i++)