fix one-byte overflow in legacy getpass function