Previously, this could (but likely wouldn't) result in accesses
outside of allocated memory, doing Very Bad Things.
Found by scan-build