Fix buffer overrun in regexp matcher