fix buffer over-read