fix out-of-bounds array access