mod_autoindex: don't read past the end of a file description - #812

terminate_description() in mod_autoindex walks a file's description one character at a time, and when a description ends inside an unterminated & entity or < tag the inner scan loop stops on the terminating NUL and the outer loop's x++ then moves one byte past it, so the following loop condition reads, and the "Grump" truncation block can write, just beyond the string. With IndexOptions ScanHTMLTitles the description is the file's <title> (find_title cuts it at the first < but it can still contain a bare &, as in "AT&T" or "R&D"), so a served file whose title an untrusted user controls can trigger it; AddressSanitizer reports a 1-byte heap read right after the allocation. The fix stops both scan loops at the NUL and breaks out of the outer loop there, so x never advances past the terminator and the output stays identical for every well-formed description.

• This PR does not report or submit a patch for a security
  vulnerability (see SECURITY.md
  and https://www.apache.org/security/#reporting-a-vulnerability).
• Code follows the httpd style guide.
• New log messages (level debug or higher) use an empty APLOGNO() tag;
  numbers are assigned by a committer at merge time
  (see docs/log-message-tags/README).
• If the change is user-visible, a changes-entries/*.txt file is included,
  following the template in README.CHANGES (not needed otherwise).