Check string bounds looking for terminating ']'.

It was possible to trigger an out-of-bounds read by giving a port
specification with '[' but not ']'.