Fix buffer size off-by-one