fix buffer overrun in on_read_core (due to the incorrect len returned by h2o_buffer_reserve)