fixed security bug - returning copy of array