fix off-by-one write in c14n namespace prefix list

external/njs_xml_module.c

@@ -1693,7 +1693,7 @@ njs_xml_parse_ns_list(njs_vm_t *vm, njs_str_t *src)
     while (*p != '\0') {
         idx = out - buf;
 
-        if (idx >= size) {
+        if (idx + 1 >= size) {
             size *= 2;
 
             n = njs_mp_alloc(njs_vm_memory_pool(vm), size * sizeof(char *));

external/qjs_xml_module.c

@@ -1740,7 +1740,7 @@ qjs_xml_parse_ns_list(JSContext *cx, u_char *src)
     while (*p != '\0') {
         idx = out - buf;
 
-        if (idx >= size) {
+        if (idx + 1 >= size) {
             size *= 2;
 
             buf = js_realloc(cx, buf, size * sizeof(char *));

test/xml/xml.t.mjs

@@ -127,6 +127,12 @@ let c14n_tsuite = {
           expected: `<n1:elem1 xmlns:n1="http://b">foo</n1:elem1>` },
         { call: (doc) => xml.exclusiveC14n(doc.pdu.elem1, null, false, 'a b c d e f g h i j'),
           expected: `<n1:elem1 xmlns:n1="http://b">foo</n1:elem1>` },
+        /* a prefix count that is a power of two exercises the namespace list
+           growth boundary, where the terminating NULL used to land one slot
+           past the buffer. */
+        { call: (doc) => xml.exclusiveC14n(doc.pdu.elem1, null, false,
+                                           Array(128).fill('n1').join(' ')),
+          expected: `<n1:elem1 xmlns:n1="http://b">foo</n1:elem1>` },
         { doc: `<note><to a="foo" b="bar">Tove</to><from>Jani</from></note>`,
           call: (doc) => xml.c14n(doc.note),
           expected: `<note><to a="foo" b="bar">Tove</to><from>Jani</from></note>` },