Fix a buffer overrun detected by AddressSanitizer.