Fix logic error in Buffer::read_more()

Buffer::read_more() is supposed to refill the buffer without discarding
its contents, which are in the range `pos .. filled`.

It mistakenly borrows the range `pos ..`, fills that, and then
increments `filled` by the amount read. This overwrites the buffer's
existing contents and sets `filled` to a too-large value that either
exposes uninitialized bytes or walks off the end of the buffer entirely.

This patch makes it correctly fill only the unfilled portion of the
buffer, which should maintain all the type invariants and fix the test
failure introduced in commit b1196717fcb.

0 files changed, 0 insertions, 0 deletions