Fix off-by-one buffer read access in format_track_path(). Part of #11947