don't access string out of bounds

Change-Id: I562fbdb9eec3af297ea95a0d161721ec345e6a19