Fixed off by one in buffer length