prevent heap overflow

jbig2_decode_symbol_dict checks whether more glyphs are requested than
are available (SDNUMINSYMS + SDNUMNEWSYMS) but has so far failed check
whether there are more than expected (SDNUMEXSYMS); fixes
3324.pdf.asan.3.2585
prevent heap underflow

jbig2_decode_mmr_line checks the arguments to jbig2_set_bits since the
fixes to issue 693050, however these checks still allow for the starting
index to be negative which results in a write underflow; fixes
2860.pdf.asan.9.2069
fix bug 694111

jbig2_image_compose fails to ensure that the destination rectangle lies
entirely within the destination buffer (in the case of the file
3324.pdf.asan.50.2585, this happens due to a huge value for y). Adding a
new check which makes sure that...

@ y * dst->stride + leftbyte doesn't overflow
@ x and leftbyte don't overflow to the next line
@ h * dst->stride doesn't overflow
@ all values read are within the destination buffer

The file 3324.pdf.asan.50.2585 also demonstrates a memory leak where the
glyph isn't properly released if jbig2_image_compose fails.