fixed bugs in cpf_verify

[hideaki]

This is fix for validation logic for CPF.

1. check for var_len is wrong. original code would read one extra byte from the buffer if the string is not null terminated.
2. check for strlen(s_cpf) is unnecessary and unsafe.
   It is unnecessary because checking i does the same thing, and it is unsafe because s_cpf is not guaranteed to be zeroed.
3. check for i is wrong. It should be compared with cpf_len instead of cpf_len-1. In the original code, valid CPFs were deemed as invalid because of this.