out of bounds read in fspec-sort: ``` while (*p++ == *q++) ; ``` This can read past the end of the paths if they are equal.