libsandbox/trace/linux/ia64.c:53 off by one error leads to memory access above array bounds

[gto2023]

struct sb_ia64_trace_regs {
  unsigned long r8, r10, r15;
  unsigned long out[6];
};
#define trace_regs struct sb_ia64_trace_regs

[...]

static long trace_get_regs(void *vregs) {
        trace_regs *regs = vregs;
[...]
        for (i = 0; i < 7; ++i)
                regs->out[i] = do_peekdata((uintptr_t)ia64_rse_skip_regs(out0, i));
[...]
}