[BUG] heap-buffer-overflow(read) pmatch() src/expand.c:1630:18

Dear Dash maintainers,

I encountered a bug in Dash in commit f8aaaa and would like to report
it. The details are provided below.

=================================================================
==4318==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x5030000003e3 at pc 0x652f51dd63bf bp 0x7ffd65724250 sp 0x7ffd65724248
READ of size 1 at 0x5030000003e3 thread T0
    #0 0x652f51dd63be in pmatch /upstream/dash/src/expand.c:1630:18
    #1 0x652f51dd74d8 in expmeta /upstream/dash/src/expand.c:1391:7
    #2 0x652f51dd1cc1 in expandmeta /upstream/dash/src/expand.c:1271:3
    #3 0x652f51dd0c2c in expandarg /upstream/dash/src/expand.c:206:3
    #4 0x652f51dc866b in evalcommand /upstream/dash/src/eval.c:806:4
    #5 0x652f51dc7855 in evaltree /upstream/dash/src/eval.c:299:12
    #6 0x652f51dc7855 in evaltree /upstream/dash/src/eval.c:299:12
    #7 0x652f51de1dd2 in cmdloop /upstream/dash/src/main.c:242:8
    #8 0x652f51de19de in main /upstream/dash/src/main.c:176:3
    #9 0x74bc543e8249 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #10 0x74bc543e8304 in __libc_start_main csu/../csu/libc-start.c:360:3
    #11 0x652f51ce3530 in _start (/upstream/dash/src/dash+0x38530)
(BuildId: 7f6a58087379909d6c654473930c3998f14e8e99)

0x5030000003e3 is located 0 bytes after 19-byte region
[0x5030000003d0,0x5030000003e3)
allocated by thread T0 here:
    #0 0x652f51d827cf in malloc (/upstream/dash/src/dash+0xd77cf) (BuildId:
7f6a58087379909d6c654473930c3998f14e8e99)
    #1 0x652f51de24d4 in ckmalloc /upstream/dash/src/memalloc.c:55:6
    #2 0x652f51dd2a8a in _rmescapes /upstream/dash/src/expand.c:1687:8
    #3 0x652f51dd55e3 in preglob /upstream/dash/src/expand.c:151:9
    #4 0x652f51dd1c81 in expandmeta /upstream/dash/src/expand.c:1266:7
    #5 0x652f51dd0c2c in expandarg /upstream/dash/src/expand.c:206:3
    #6 0x652f51dc866b in evalcommand /upstream/dash/src/eval.c:806:4
    #7 0x652f51dc7855 in evaltree /upstream/dash/src/eval.c:299:12
    #8 0x652f51dc7855 in evaltree /upstream/dash/src/eval.c:299:12
    #9 0x652f51de1dd2 in cmdloop /upstream/dash/src/main.c:242:8
    #10 0x652f51de19de in main /upstream/dash/src/main.c:176:3
    #11 0x74bc543e8249 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow
/upstream/dash/src/expand.c:1630:18 in pmatch
Shadow bytes around the buggy address:
  0x503000000100: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
  0x503000000180: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
  0x503000000200: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x503000000280: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
  0x503000000300: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
=>0x503000000380: 00 00 fa fa 00 00 03 fa fa fa 00 00[03]fa fa fa
  0x503000000400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x503000000480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x503000000500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x503000000580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x503000000600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4318==ABORTING

////////////////
Place in code
////////////////
                                        if (chr == c)
                                                found = 1;
                                }
                 ---->} while ((c = *p++) != ']');
                        if (found == invert)
                                return 0;
                        q++;


////////////////
My environment:
////////////////

Debian-12, x86-64, clang-19 compiler

/////////////////
Steps to reproduce:
/////////////////

$ aclocal && autoheader && automake --add-missing && autoconf
$ CC=clang CFLAGS=" -Wno-everything -fsanitize=address -g -O0" ./configure
--disable-fnmatch --disable-lineno --disable-glob
$ make
$ cd src
$ ./dash < myfile.txt

//////////////////
Steps to get myfile.txt:
//////////////////

copy the text into file bs64.txt (between ==== and ======):
=====================================================================================
PkA3OyRCLWdlIFuFaZs/PwJlc3Nzc3Nzc3Mt
=====================================================================================
Or just take from attachments:

>@7;$B-ge [卛?essssssss-