fix off-by-one array access