don't access beyond end of string

as shown by assert in fdo37872-1

Change-Id: Iccc27b7898a72a0f580c0e8996c8e69de7ea8842