gh-17645: avoid oob read on conflict marker detection

Introduced in 0ae5281.

Author: hvds

t/lib/croak/toke

@@ -565,7 +565,7 @@ EXPECT
 OPTIONS regex
 Use of code point 0x80000000(00000000)? is not allowed; the permissible max is 0x7FFFFFFF(FFFFFFFF)? at - line \d+.
 ########
-# TODO gh-17645: conflict marker detection should not read out of bounds
+# NAME gh-17645: conflict marker detection should not read out of bounds
 m/$0[
 ==0/
 EXPECT

toke.c

@@ -8835,7 +8835,7 @@ yyl_try(pTHX_ char *s, STRLEN len)
 
     case '=':
         if (s[1] == '=' && (s == PL_linestart || s[-1] == '\n')
-            && memBEGINs(s + 2, (STRLEN) (PL_bufend - s + 2), "====="))
+            && memBEGINs(s + 2, (STRLEN) (PL_bufend - (s + 2)), "====="))
         {
             s = vcs_conflict_marker(s + 7);
             goto retry;
@@ -8929,7 +8929,7 @@ yyl_try(pTHX_ char *s, STRLEN len)
 
     case '<':
         if (s[1] == '<' && (s == PL_linestart || s[-1] == '\n')
-            && memBEGINs(s+2, (STRLEN) (PL_bufend - (s+2)), "<<<<<"))
+            && memBEGINs(s + 2, (STRLEN) (PL_bufend - (s + 2)), "<<<<<"))
         {
             s = vcs_conflict_marker(s + 7);
             goto retry;
@@ -8938,7 +8938,7 @@ yyl_try(pTHX_ char *s, STRLEN len)
 
     case '>':
         if (s[1] == '>' && (s == PL_linestart || s[-1] == '\n')
-            && memBEGINs(s + 2, (STRLEN) (PL_bufend - s + 2), ">>>>>"))
+            && memBEGINs(s + 2, (STRLEN) (PL_bufend - (s + 2)), ">>>>>"))
         {
             s = vcs_conflict_marker(s + 7);
             goto retry;