Fix buffer size boundary check offset by 1