regexec.c: avoid overflow in realloc buffer length computation