From ea6891fb8aebe0d8ab0337e5fbc5cd037b0106d8 Mon Sep 17 00:00:00 2001
From: Dhanraj E <dhanraj@labs.digiscrypt.com>
Date: Fri, 9 Oct 2026 20:38:17 +0530
Subject: [PATCH] Fix off-by-one buffer growth in sixel_print_add

---
 image-sixel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-sixel.c b/image-sixel.c
index a004d78f8..75dc5ee41 100644
--- a/image-sixel.c
+++ b/image-sixel.c
@@ -481,7 +481,7 @@ static void
 sixel_print_add(char **buf, size_t *len, size_t *used, const char *s,
     size_t slen)
 {
-	while (*used + slen >= *len + 1) {
+	while (*used + slen + 1 > *len) {
 		*buf = xreallocarray(*buf, 2, *len);
 		(*len) *= 2;
 	}