Hi,

another bug in LuaTeX: If LuaTeX tries to calculate the size of a CFF table where the second entry in the table is a real number,
`pack_real` is called with `work_buffer+i` for a small `i`.
This causes aliasing issues because `work_buffer` writes into `work_buffer` using `sprintf`.
So the output from `pack_real` modifies `work_buffer` before the digits are read completely,
causing LuaTeX to complain about a "invalid character".

An example to reproduce the issue:

Run the following plainTeX document with the attached version of `LOGO10.otf` (the font was created by reordering
the Private table entries and has an invalid checksum, but this is ignored by LuaTeX)