Fix ancient off-by-one at end boundary in string array size calculation

Fix ancient off-by-one at end boundary in string array size calculation

- String array size calculation could read one byte past data end
  pointer when expected count and number of \0's disagree (ie invalid data)
  due to while condition side-effects + bounds checking being in
  the inner loop.
- Lift the string length calculation to inline helper function, used for
  both string and string array types.
- Streamline the calculations:
  - Eliminate unnecessary length increments, calculate the length
    from pointer distance
  - Eliminate end pointer NULL checking within the loop: when caller
    doesn't supply end pointer, cap to HEADER_MAX_DATA (ie 16MB),
    anything larger would trip up in later hdrchkData() checks anyway.
  - Avoid the off-by-one by eliminating the problematic inner loop.