Don't use strlen() to calculate the length of

Don't use strlen() to calculate the length of
the pcrs substitutes. They don't have to be valid C
strings and getting their length wrong can result in
user-controlled memory corruption.

Thanks to Felix Gröbert for reporting the problem
and providing the fix [#1627140].