mdec: check for out of bounds read