term: fix crash when an OSC-8 URI wraps around the scrollback

Long OSC-8 URIs, that are split up over multiple rows, are handled by
emitting one URI range on each row the URL touches.

This was done by initializing a row index variable, and then
incrementing it each loop iteration.

This caused an out-of-bounds array access when the row index reached
the maximum number of scrollback lines.

The fix is simple: make sure the row index variable wraps around,
instead of incrementing without any bounds.

Closes #552

CHANGELOG.md

@@ -133,6 +133,8 @@
 * Regression where `<mod>+shift+tab` always produced `\E[Z` instead of
   the correct `\E[27;<mod>;9~` sequence
   (https://codeberg.org/dnkl/foot/issues/547).
+* Crash when a line wrapping OSC-8 URI crossed the scrollback wrap
+  around (https://codeberg.org/dnkl/foot/issues/552).
 
 
 ### Security

terminal.c

@@ -3084,7 +3084,7 @@ term_osc8_close(struct terminal *term)
 
     int r = start.row;
     int start_col = start.col;
-    do {
+    while (true) {
         int end_col = r == end.row ? end.col : term->cols - 1;
 
         struct row *row = term->grid->rows[r];
@@ -3121,7 +3121,13 @@ term_osc8_close(struct terminal *term)
         }
 #endif
         start_col = 0;
-    } while (r++ != end.row);
+
+        if (r == end.row)
+            break;
+
+        r++;
+        r &= term->grid->num_rows - 1;
+    }
 
 done:
     free(term->vt.osc8.uri);