Fix buffer overflow due to off-by-one error