Fix `copy_to_slice` to use correct increment var

This patch fixes the `copy_to_slice` function, rectifying the logic.
However, the incorrect code does not result in incorrect behavior as the
only case `cnt != src.len()` is during the final iteration, and since
`src.len()` is greater than `cnt` in that case, `off` will be
incremented by too much, but this will still trigger the `off <
dst.len()` condition.

The only danger is `src.len()` could cause an overflow.

src/buf/buf.rs

@@ -218,7 +218,7 @@ pub trait Buf {
                 ptr::copy_nonoverlapping(
                     src.as_ptr(), dst[off..].as_mut_ptr(), cnt);
 
-                off += src.len();
+                off += cnt;
             }
 
             self.advance(cnt);