The comment before fixupMultiSZ and countString states:

** Note that fixupMultiSZ and countString have both had changes
** made to support "incorrect strings".  The registry specification
** calls for strings to be terminated with 2 null bytes.  It seems
** some commercial packages install strings which don't conform,
** causing this code to fail - however, "regedit" etc still work
** with these strings (ie only we don't!).

As indicated in the comments, the two functions dutifully check the supplied length parameter and do not trust the data to be in the correct format.

... except for the inner loop in fixupMultiSZ, which reads:

                for(; *P != '\0'; P++)
                        ;

It should be the same as the inner loop of countStrings:

                for (; P < Q && *P != '\0'; P++)
                        ;