Segfault in act_txtobj

observed with 3a73f0432a014da0a776816ef362d0fa8c48ffa09f63851e8e5c8eeba01cf992

stack trace:

#0  memcpy (dst0=0x89191261027, src0=0x3fe63c9eecbfb15b, length=804017878)
    at /usr/src/lib/libc/string/memcpy.c:97
97                      TLOOP1(*dst++ = *src++);
(gdb) bt
#0  memcpy (dst0=0x89191261027, src0=0x3fe63c9eecbfb15b, length=804017878)
    at /usr/src/lib/libc/string/memcpy.c:97
#1  0x0000088e8f7090a7 in act_txtobj (p=0x891202096e0, u=0x7f7fffff2810)
    at pdf.c:2059
#2  0x00000891070475f5 in parse_action () from /usr/local/lib/libhammer.so
#3  0x00000891070547ed in h_do_parse () from /usr/local/lib/libhammer.so
#4  0x000008910704eb7b in parse_many () from /usr/local/lib/libhammer.so
#5  0x00000891070547ed in h_do_parse () from /usr/local/lib/libhammer.so
#6  0x0000089107048597 in parse_bind () from /usr/local/lib/libhammer.so
#7  0x00000891070547ed in h_do_parse () from /usr/local/lib/libhammer.so
#8  0x0000089107054bfb in h_packrat_parse () from /usr/local/lib/libhammer.so
#9  0x00000891070633bd in h_parse () from /usr/local/lib/libhammer.so
#10 0x0000088e8f71271d in parse_pagenode (aux=0x7f7fffff2810, 
    myNode=0x890a91b7320, myRef=0x8914ef33af8, myDict=0x890b0b205e8, 
    parent_t=0x8916f6c1af8, parent_n=0x8909e06db00, arena=0x890c7485000)
    at pdf.c:4060
#11 0x0000088e8f713116 in parse_pagetree (aux=0x7f7fffff2810, 
    myNode=0x8909e06db00, myRef=0x8916f6c1af8, myDict=0x8912f5d95c8, 
    parent_t=0x890f8060ad0, parent_n=0x7f7fffff2860) at pdf.c:4243
#12 0x0000088e8f713064 in parse_pagetree (aux=0x7f7fffff2810, 
    myNode=0x7f7fffff2860, myRef=0x890f8060ad0, myDict=0x8917a49e5e8, 
    parent_t=0x0, parent_n=0x0) at pdf.c:4237
#13 0x0000088e8f7133c8 in parse_catalog (aux=0x7f7fffff2810, 
    root=0x89092d09580) at pdf.c:4314
#14 0x0000088e8f714a5f in parse_xrefs (aux=0x7f7fffff2810) at pdf.c:4932
#15 0x0000088e8f714fd9 in main (argc=1, argv=0x7f7fffff29e8) at pdf.c:5071

relevant code (pdf.c, act_txtobj):

        case TW_Tj:
            memcpy(&tstr[idx], txte->tstr.text, txte->tstr.nchars);