We know that pointers give beginning location of Payload in SONET/SDH frame.So how to get end of payload info?

Actually  SPE(synchronous payload envelope)  can start anywhere within the SONET payload, which necessitates the need for a pointer to point to the beginning of the SPE.

Lets consider that  the SPE begins on byte 276 (fourth row, sixth column) of frame i, and ends at byte 275 (fourth row, fifth column) of the next frame i + 1. The next SPE starts immediately, on byte 276 of frame i + 1, and so on. In general, SONET assumes that the SPE can be floated within the payload of the frame, and it provides a pointer in the overhead section for locating its beginning.

As we know that  the beginning location of frame is given by H1H2 value and also that H1+H2 indicates the offset (in bytes) from H3 to the SPE (i.e. if 0 then J1 POH byte is immediately after H3 in the row). Similarly end can be found because each SPE has a fixed number of bytes.

In H1+H2, 4 MSBs are New Data Flag, 10 LSBs are actual offset value (0 – 782).

So, When offset=522 the STS-1 SPE is in a single STS-1 frame. And In all other cases the SPE straddles two frames When offset is a multiple of 87, the SPE is rectangular. This all happens with ideal synchronization conditions else H3 byte take cares further.
Some fixed start and end locations for various payloads are:-
Pointer Range: 0-103 (VT1.5 type)
Pointer Range: 0-139 (VT2 type)
Pointer Range: 0-211 (VT3 type)
Pointer Range: 0-427 (VT6 type)
Pointer Range: 0-782 (SPE,STS-1 type)
Pointer Range: 0-2339 (STS-3c type)