Fix overflow in path building

An incorrect size was causing an unsigned value
to wrap, causing it to write past the end of
the buffer.

Bug: 28085658
Change-Id: Ie9625c729cca024d514ba2880ff97209d435a165
(cherry picked from commit 6ea6c04ca695e0f0b6bcf3ea4529b9fd74fee8e4)