Fix bounds check in nextByte
Fix bounds overflow in sprintTxt

Passing excessively long strings (>256*4+3) to sprintTxt would result in
overflowing src. Fix isn't as efficient but simplifies the code.