Fix bug: forgot to limit buffer size when requesting target buffer