Fix out-of-bounds acces in url_decode()