fix CVE-2013-2110 - use correct formula to calculate string size