netfilter: ipset: small potential read beyond the end of buffer