fix an overflow bug in fill_insn()