Fix various buffer issues (Fixes BUGZ-4210)
A stack of related patches that can be applied more or less individually if necessary:
- fix a buffer overrun problem, as warned by Clang; see BUGZ-4206 no (9)
- don't allocate space for a field that is never used, just skip it during scanning
- don't repeat literal buffer sizes in the code, but define them and then use the definitions
- don't assume malloc always succeeds, and don't assume sizeof(char) is anything except 1
The first one is the most important one. The others are good hygiene, the bug has a little more info.