Fix out of bounds read (Brooks Davis)
(reproduce by starting tcsh and hitting tab at the prompt)

See:
http://mx.gw.com/pipermail/tcsh-bugs/2016-December/001103.html
for more details.

Upstream fix at:
https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596

--- tcsh-6.19.00/ed.chared.c.orig	2016-12-07 06:26:09.076227132 +0000
+++ tcsh-6.19.00/ed.chared.c	2016-12-07 06:26:41.976633276 +0000
@@ -750,7 +750,7 @@
     /*
      * If we found a history character, go expand it.
      */
-    if (HIST != '\0' && *p == HIST)
+    if (p >= InputBuf && HIST != '\0' && *p == HIST)
 	nr_exp = c_excl(p);
     else
         nr_exp = 0;