buf: buf_ash: fix buffer overrrun.

* buf.c (buf_ash): Loop must be clamped the
smaller length of the result, cnlen.

1 files changed, 1 insertions, 1 deletions

diff --git a/buf.c b/buf.c
index e83eb121..0bb21a5c 100644
--- a/buf.c
+++ b/buf.c
@@ -1456,7 +1456,7 @@ val buf_ash(val buf, val bits)
       struct buf *nbh = buf_handle(nbuf, self);
       ucnum i;
 
-      for (i = 0; i < len; i++) {
+      for (i = 0; i < cnlen; i++) {
         unsigned by = bh->data[i + v];
         nbh->data[i] = (by | acc) >> r;
         acc = by << 8;