When the passed path was longer than the local buffer, while still
passing the `opendir()` call (e.g. `/\0` followed by padding), the access
via original chunk length to write a final `/` wrote outside of the
buffer. The same could happen later when adding directory names because
`path_len` was based on that same length.
Fixes: 2ea1dac203 ("libimcv: Support symlinks introduced by usrmerge")
Tobias Brunner
2dfc1ac1a8