fix out-of-bounds write stripping section comments in help_load_file

[aizu-m]

Isolated the <!-- SECTION: --> parsing from help_load_file() under ASan and fed it a comment with no text:

help-index.c: AddressSanitizer: stack-buffer-overflow
READ of size 1 ... offset 1183 ... underflows this variable 'section'

Tracked it down from there. ptr indexes into section after the cupsCopyString(section, ...), but the trailing-strip loop guards the walk with ptr > line. line and section are separate stack buffers, so that test never bounds ptr inside section.

A section that is empty or all-whitespace up to --> (e.g. <!-- SECTION:-->) puts ptr at section[0]. The guard against line then lets the loop decrement past the start of section, writing \0 over the adjacent stack, and the following isspace(*ptr & 255) reads out of bounds too.

Bound the walk to section and drop the stray trailing test. Valid section comments strip the same as before.

[michaelrsweet]

I'm not sure I like the new code... Will refactor...

[michaelrsweet]

[master 34b3dac] Fix section parsing in web help index code (Issue #1641)

[2.4.x 7a899c6] Fix section parsing in web help index code (Issue #1641)