fix out-of-bounds access in UTF-8 decoding