bugfix: don't deref vector beyond size