fix an out-of-bounds memory access

in this particular case, this OOB is always harmless
(and that's why it didn't get fixed from MR1), however,
it interfers with valgrind debugging.

Change-Id: Ic977e03287e59c4b124a89146c9023bd0cb540a8