Fixed possible read after end of buffer and use after free.