Fixed #4840 (false negative: buffer access out of bounds)