fixed bugs spotted by address-sanitizer