fix bug in buffer length accounting