fix buffer overrun by 1