check string bounds

Change-Id: I92f2dbbe12956ee9432d592851f10bceaa5ce25d