From 4258180bc7944a81e1e0a8672a283ae91dacf8fb Mon Sep 17 00:00:00 2001
From: Kartik Naik <kartik@bugqore.com>
Date: Thu, 27 Aug 2026 18:52:10 +0530
Subject: [PATCH] fix off-by-one heap write in pcre2test pattern expand buffer

---
 src/pcre2test_inc.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pcre2test_inc.h b/src/pcre2test_inc.h
index 69c64f731..c4e0f6708 100644
--- a/src/pcre2test_inc.h
+++ b/src/pcre2test_inc.h
@@ -2289,7 +2289,7 @@ else if ((pat_patctl.control & CTL_EXPAND) != 0)
     expanding buffers always keeps buffer and pbuffer8 in step as far as their
     size goes. */
 
-    while (pt + count * length > pbuffer8 + pbuffer8_size)
+    while (pt + count * length >= pbuffer8 + pbuffer8_size)
       {
       size_t pc_offset = pc - buffer;
       size_t pp_offset = pp - buffer;