It is illegal to construct out-of-bound pointers, even if they are not
dereferenced. The current bound checks rely on undefined behaviour.
Fix this by introducing convenience macros that check the remaining
length.

The loop checks against `p` but increases `p2`. I don't see the point of
having 2 separate variables, so use `p` instead to correct the bounds
check and simplify the code in the process.

...ile size
We change the order of operations such that the file size check cannot
overflow in the for loop. This prevents infinite loops.
We also add an overflow check at the end of the loop body to prevent the
addition of offset and box.size from overflowing.