url: fix out-of-bound read