[BUG] heap-buffer-overflow(read) padvance_magic() exec.c:232:8

Hello Dash maintainers,

I encountered a bug in Dash in commit b4ef25d7 and would like to report
it. The details are provided below.
=================================================================
==19628==ERROR: AddressSanitizer: heap-buffer-overflow on address 
0x5020000001f6 at pc 0x653a8d802916 bp 0x7ffd57f3d590 sp 0x7ffd57f3cd50
READ of size 2 at 0x5020000001f6 thread T0
     #0 0x653a8d802915 in strcspn (/upstream/dash/src/dash+0x55915) 
(BuildId: 82ec7cbb990c5349f280ce0bf016a1bca211dffd)
     #1 0x653a8d8d01af in padvance_magic /upstream/dash/src/exec.c:232:8
     #2 0x653a8d8d0081 in padvance /upstream/dash/src/./exec.h:88:9
     #3 0x653a8d8d1d05 in find_command /upstream/dash/src/exec.c:439:16
     #4 0x653a8d8cc013 in evalcommand /upstream/dash/src/eval.c:896:3
     #5 0x653a8d8ca925 in evaltree /upstream/dash/src/eval.c:305:12
     #6 0x653a8d8e7762 in cmdloop /upstream/dash/src/main.c:246:8
     #7 0x653a8d8e736f in main /upstream/dash/src/main.c:180:3
     #8 0x7dd5c0958249 in __libc_start_call_main 
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
     #9 0x7dd5c0958304 in __libc_start_main csu/../csu/libc-start.c:360:3
     #10 0x653a8d7e65d0 in _start (/upstream/dash/src/dash+0x395d0) 
(BuildId: 82ec7cbb990c5349f280ce0bf016a1bca211dffd)
0x5020000001f6 is located 0 bytes after 6-byte region 
[0x5020000001f0,0x5020000001f6)
allocated by thread T0 here:
     #0 0x653a8d88586f in malloc (/upstream/dash/src/dash+0xd886f) 
(BuildId: 82ec7cbb990c5349f280ce0bf016a1bca211dffd)
     #1 0x653a8d8e7e64 in ckmalloc /upstream/dash/src/memalloc.c:66:6
     #2 0x653a8d90123d in setvar /upstream/dash/src/var.c:213:23
     #3 0x653a8d9035ba in unsetvar /upstream/dash/src/var.c:613:2
     #4 0x653a8d903547 in unsetcmd /upstream/dash/src/var.c:597:4
     #5 0x653a8d8cee10 in evalbltin /upstream/dash/src/eval.c:975:12
     #6 0x653a8d8cc183 in evalcommand /upstream/dash/src/eval.c:923:7
     #7 0x653a8d8ca925 in evaltree /upstream/dash/src/eval.c:305:12
     #8 0x653a8d8e7762 in cmdloop /upstream/dash/src/main.c:246:8
     #9 0x653a8d8e736f in main /upstream/dash/src/main.c:180:3
     #10 0x7dd5c0958249 in __libc_start_call_main 
csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow 
(/upstream/dash/src/dash+0x55915) (BuildId: 
82ec7cbb990c5349f280ce0bf016a1bca211dffd) in strcspn
Shadow bytes around the buggy address:
   0x501fffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x501fffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x502000000000: fa fa fd fa fa fa 00 04 fa fa 00 04 fa fa 00 04
   0x502000000080: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
   0x502000000100: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
=>0x502000000180: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa[06]fa
   0x502000000200: fa fa 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
   0x502000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x502000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x502000000380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x502000000400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07
   Heap left redzone:       fa
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb
==19628==ABORTING

Environment:
Debian-12, x86-64
clang-19 compiler

Steps to reproduce:

./autogen.sh
CC=clang CFLAGS=" -fsanitize=address -g " ./configure --disable-fnmatch
--disable-lineno --disable-glob
make
cd src
echo -e 'unset PATH\n0' | ./dash

Also I think I should show my env:

root@ecf61be3acf6:/upstream/dash/src# env
HOSTNAME=ecf61be3acf6
PWD=/upstream/dash/src
SRC=/dash
LLVM_CONFIG=/usr/bin/llvm-config-19
TZ=Europe/Moscow
HOME=/root
LANG=ru_RU.UTF-8
https_proxy=
TERM=xterm
SHLVL=1
http_proxy=
SHARED=/shared
PATH=/root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
OUT=/out
OLDPWD=/upstream/dash
_=/usr/bin/env