fix oob write