fix end-of-buffer check

code properly checked that pointer was still within buffer
and then adjusted the pointer, resulting in possible OOB reference.

Bug: 204445255
Test: ran poc from bug
Change-Id: I731341c6ee46a011a7535b8a2b04ebc03711b1a7