fix a potential bug with readlink(2)

According to linux manual READLINK(2)
```
   readlink() places the contents of the symbolic link pathname in the buffer
   buf,  which has size bufsiz. readlink() does not append a null byte to buf.
   It will truncate the contents (to a length of bufsiz characters), in case
   the buffer is too small to hold all of the contents.
```
there is a situation that readlink returns bufsize when the path is long enough
, and in that situation we would write \0 to the invalid address buf[bufsize].
obviously it is not allowed.
I doubt it should be  `buf[l] = '\0'` here, not `l-1`.