Fix buffer overflow in var_expressions.c