fix regexps_append_state buffer overread