libvncserver/font.c: add some checks to rfbDrawChar().

In some cases (bad font data) the coordinates evaluate to <0,
causing a segfault in the following memcpy().

[jes: keep the offset, but do not try to segfault]
Signed-off-by: Christian Beier <dontmind@freeshell.org>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

libvncserver/font.c

@@ -24,7 +24,8 @@ int rfbDrawChar(rfbScreenInfoPtr rfbScreen,rfbFontDataPtr font,
 	d=*data;
 	data++;
       }
-      if(d&0x80)
+      if(d&0x80 && y+j >= 0 && y+j < rfbScreen->height &&
+          x+i >= 0 && x+i < rfbScreen->width)
 	memcpy(rfbScreen->frameBuffer+(y+j)*rowstride+(x+i)*bpp,colour,bpp);
       d<<=1;
     }