run-time /(?{})/: fix an buffer overrun

String length calculation didn't allow for trailing nul.
(spotted by Nicholas)

diff --git a/regcomp.c b/regcomp.c
index 038a4a6..7500e37 100644 (file)
--- a/regcomp.c
+++ b/regcomp.c
@@ -5041,7 +5041,7 @@ S_compile_runtime_code(pTHX_ RExC_state_t * const pRExC_state,
        int n = 0;
        STRLEN s;
        char *p, *newpat;
-       int newlen = plen + 5; /* allow for "qr''x" extra chars */
+       int newlen = plen + 6; /* allow for "qr''x\0" extra chars */
        SV *sv, *qr_ref;
        dSP;