fix off-by-one in the string validation check