PR23940, check bounds before using