merge: fix out-of-bounds memory access