Fix buffer overflow found by clang