Fix BOF while copying passchar to passdisp.

There's a buffer overflow bug while copying passchar to passdisp since the value of  i + j  is not checked.
Something bad may happen if passchar is very long, which might let a normal user get the permission of root.