fixed the bug of scope

For simplicitly, let's assume PAGESIZE=10. If function=7 and len=3, the
replacement code would go into bytes 7,8 and 9. However, the check
would be:
if (0+10 <= 7+3)