[BUG] heap-buffer-overflow(read) _rmescapes() src/expand.c:2088:9

Hello Dash maintainers,

I encountered a bug in Dash in commit b4ef25d7 and would like to report
it. The details are provided below.

=================================================================
==19757==ERROR: AddressSanitizer: heap-buffer-overflow on address 
0x515000000500 at pc 0x6187826bab84 bp 0x7ffff71dca90 sp 0x7ffff71dca88
READ of size 1 at 0x515000000500 thread T0
     #0 0x6187826bab83 in _rmescapes /upstream/dash/src/expand.c:2088:9
     #1 0x6187826bc389 in expari /upstream/dash/src/expand.c:517:3
     #2 0x6187826b850a in argstr /upstream/dash/src/expand.c:397:8
     #3 0x6187826b7c57 in expandarg /upstream/dash/src/expand.c:232:2
     #4 0x6187826af73b in evalcommand /upstream/dash/src/eval.c:819:4
     #5 0x6187826ae925 in evaltree /upstream/dash/src/eval.c:305:12
     #6 0x6187826b352c in evalfun /upstream/dash/src/eval.c:1017:2
     #7 0x6187826b024c in evalcommand /upstream/dash/src/eval.c:931:7
     #8 0x6187826ae925 in evaltree /upstream/dash/src/eval.c:305:12
     #9 0x6187826ae925 in evaltree /upstream/dash/src/eval.c:305:12
     #10 0x6187826cb762 in cmdloop /upstream/dash/src/main.c:246:8
     #11 0x6187826cb36f in main /upstream/dash/src/main.c:180:3
     #12 0x78cf309b3249 in __libc_start_call_main 
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
     #13 0x78cf309b3304 in __libc_start_main csu/../csu/libc-start.c:360:3
     #14 0x6187825ca5d0 in _start (/upstream/dash/src/dash+0x395d0) 
(BuildId: 82ec7cbb990c5349f280ce0bf016a1bca211dffd)
0x515000000500 is located 0 bytes after 512-byte region 
[0x515000000300,0x515000000500)
allocated by thread T0 here:
     #0 0x61878266986f in malloc (/upstream/dash/src/dash+0xd886f) 
(BuildId: 82ec7cbb990c5349f280ce0bf016a1bca211dffd)
     #1 0x6187826cbe64 in ckmalloc /upstream/dash/src/memalloc.c:66:6
     #2 0x6187826cbfde in stalloc /upstream/dash/src/memalloc.c:134:8
     #3 0x6187826cc7cd in growstackblock /upstream/dash/src/memalloc.c:238:7
     #4 0x6187826cc831 in growstackto /upstream/dash/src/memalloc.c:277:10
     #5 0x6187826cc87e in makestrspace /upstream/dash/src/memalloc.c:289:9
     #6 0x6187826cc8b0 in stnputs /upstream/dash/src/memalloc.c:294:6
     #7 0x6187826b809c in argstr /upstream/dash/src/expand.c:326:8
     #8 0x6187826b7c57 in expandarg /upstream/dash/src/expand.c:232:2
     #9 0x6187826b2621 in fill_arglist /upstream/dash/src/eval.c:680:3
     #10 0x6187826af401 in evalcommand /upstream/dash/src/eval.c:788:13
     #11 0x6187826ae925 in evaltree /upstream/dash/src/eval.c:305:12
     #12 0x6187826b352c in evalfun /upstream/dash/src/eval.c:1017:2
     #13 0x6187826b024c in evalcommand /upstream/dash/src/eval.c:931:7
     #14 0x6187826ae925 in evaltree /upstream/dash/src/eval.c:305:12
     #15 0x6187826ae925 in evaltree /upstream/dash/src/eval.c:305:12
     #16 0x6187826cb762 in cmdloop /upstream/dash/src/main.c:246:8
     #17 0x6187826cb36f in main /upstream/dash/src/main.c:180:3
     #18 0x78cf309b3249 in __libc_start_call_main 
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: heap-buffer-overflow 
/upstream/dash/src/expand.c:2088:9 in _rmescapes

Shadow bytes around the buggy address:

   0x515000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x515000000300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x515000000380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x515000000400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x515000000480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x515000000500:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x515000000580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x515000000600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x515000000680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x515000000700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x515000000780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07
   Heap left redzone:       fa
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb
==19757==ABORTING

Environment:

Debian-12, x86-64
clang-19 compiler

Steps to reproduce:

./autogen.sh
CC=clang CFLAGS=" -fsanitize=address -g " ./configure --disable-fnmatch
--disable-lineno --disable-glob
make
cd src
echo -ne 'testfail()\n{\nt   exitval=$((exitval + \x81))\n}\n\ntest 
"${empty:-ok}" = ok || testfail "empty var colon"\ntest "${empty-bad}" = 
"" || testfail "got \"${empty-bad}\": empty var nocolon"' | ./dash