[kerx] Make sure subtables are non-zero-length

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11400

src/hb-aat-layout-kerx-table.hh

@@ -812,6 +812,7 @@ struct KerxSubTable
   {
     TRACE_SANITIZE (this);
     if (!u.header.sanitize (c) ||
+	u.header.length <= u.header.static_size ||
 	!c->check_range (this, u.header.length))
       return_trace (false);
 

src/hb-aat-layout-morx-table.hh

@@ -915,7 +915,7 @@ struct ChainSubtable
   {
     TRACE_SANITIZE (this);
     if (!length.sanitize (c) ||
-	length < min_size ||
+	length <= min_size ||
 	!c->check_range (this, length))
       return_trace (false);