fix buffer overrun bug