fix buffer overrun