fix missing integer overflow checks in regexec buffer size computations