mqtt: fix an out-of-bounds write