run-time /(?{})/: fix an buffer overrun

String length calculation didn't allow for trailing nul.
(spotted by Nicholas)

1 files changed, 1 insertions, 1 deletions

diff --git a/regcomp.c b/regcomp.c
index 038a4a6c27..7500e37052 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -5041,7 +5041,7 @@ S_compile_runtime_code(pTHX_ RExC_state_t * const pRExC_state,
 	int n = 0;
 	STRLEN s;
 	char *p, *newpat;
-	int newlen = plen + 5; /* allow for "qr''x" extra chars */
+	int newlen = plen + 6; /* allow for "qr''x\0" extra chars */
 	SV *sv, *qr_ref;
 	dSP;