protect against out of bounds read