SECURITY: fixed fix to buffer handling