Fixed #4554 (false negative: buffer access out of bounds)