fix SetCipherList() possible 1 byte overrun