Bug 902: set_hline: Allocate memory for one more character cell.

src/document/html/renderer.c

@@ -404,8 +404,20 @@ set_hline(struct html_context *html_context, unsigned char *chars, int charslen,
 		return 0;
 
 	if (part->document) {
+		/* Reallocate LINE(y).chars[] to large enough.  The
+		 * last parameter of realloc_line is the index of the
+		 * last element to which we may want to write,
+		 * i.e. one less than the required size of the array.
+		 * Compute the required size by assuming that each
+		 * byte of input will need at most one character cell.
+		 * (All double-cell characters take up at least two
+		 * bytes in UTF-8, and there are no triple-cell or
+		 * wider characters.)  However, if there already is an
+		 * incomplete character in part->document->buf, then
+		 * the first byte of input can result in a double-cell
+		 * character, so we must reserve one extra element.  */
 		if (realloc_line(html_context, part->document,
-		                 Y(y), X(x) + charslen - 1))
+		                 Y(y), X(x) + charslen))
 			return 0;
 		if (utf8) {
 			unsigned char *end = chars + charslen;