Fix reading past buffer boundary in RSSyl's strreplace.