The +4 is for 2 CRLF pairs, as the comment above states.

As for the chunkSize, not sure what you're referring to with buffer overrun attacks?  `chunkSize` is the length of the application supplied byte array formatted as a hex String - that is, it's something that we created, not untrusted input.  It, if the application supplied a 30 byte array, chunkSize will be "1E".  The `chunk` array that it's being copied to is also something that we created, and we created it at the exact length to fit the chunkSize string, plus the array, plus the two delimiting CRLF words.