Fix length checks in string conversion functions

We need to check the buffer length before accessing the incoming
string. Probably not a problem in practice as there should be a
final null in most incoming strings.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

common/rfb/util.cxx

     // Compute output size
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       if (*in != '\r') {
         sz++;
         in++;
         continue;
       }
 
-      if ((in_len == 0) || (*(in+1) != '\n'))
+      if ((in_len < 2) || (*(in+1) != '\n'))
         sz++;
 
       in++;
     out = buffer;
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       if (*in != '\r') {
         *out++ = *in++;
         in_len--;
         continue;
       }
 
-      if ((in_len == 0) || (*(in+1) != '\n'))
+      if ((in_len < 2) || (*(in+1) != '\n'))
         *out++ = '\n';
 
       in++;
     // Compute output size
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       sz++;
 
       if (*in == '\r') {
-        if ((in_len == 0) || (*(in+1) != '\n'))
+        if ((in_len < 2) || (*(in+1) != '\n'))
           sz++;
       } else if (*in == '\n') {
         if ((in == src) || (*(in-1) != '\r'))
     out = buffer;
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       if (*in == '\n') {
         if ((in == src) || (*(in-1) != '\r'))
           *out++ = '\r';
       *out = *in;
 
       if (*in == '\r') {
-        if ((in_len == 0) || (*(in+1) != '\n')) {
+        if ((in_len < 2) || (*(in+1) != '\n')) {
           out++;
           *out = '\n';
         }
     // Compute output size
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       char buf[5];
       sz += ucs4ToUTF8(*in, buf);
       in++;
     out = buffer;
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       out += ucs4ToUTF8(*in, out);
       in++;
       in_len--;
     // Compute output size
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       size_t len;
       unsigned ucs;
 
     out = buffer;
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       size_t len;
       unsigned ucs;
 
     // Compute output size
     in = src;
     in_len = units;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       size_t len;
       unsigned ucs;
       char buf[5];
     out = buffer;
     in = src;
     in_len = units;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       size_t len;
       unsigned ucs;
 
     // Compute output size
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       size_t len;
       unsigned ucs;
       wchar_t buf[3];
     out = buffer;
     in = src;
     in_len = bytes;
-    while ((*in != '\0') && (in_len > 0)) {
+    while ((in_len > 0) && (*in != '\0')) {
       size_t len;
       unsigned ucs;