fix for CIDs 26950/26951 - Out-of-bounds read