XPath: evaluate_string now guarantees zero-terminated result (unless the buffer size is zero)

git-svn-id: http://pugixml.googlecode.com/svn/trunk@762 99668b35-9821-0410-8761-19e4c4f06640

1 files changed, 10 insertions, 4 deletions

diff --git a/src/pugixml.cpp b/src/pugixml.cpp
index 903416c..1d049a2 100644
--- a/src/pugixml.cpp
+++ b/src/pugixml.cpp
@@ -9321,12 +9321,18 @@ namespace pugi
 
 		xpath_string r = evaluate_string_impl(_root, n, sd);
 
-		size_t size = r.length() + 1;
+		size_t full_size = r.length() + 1;
 		
-		// $$ zero-terminate?
-		if (capacity > 0) memcpy(buffer, r.c_str(), (size < capacity ? size : capacity) * sizeof(char_t));
+		if (capacity > 0)
+        {
+            size_t size = (full_size < capacity) ? full_size : capacity;
+            assert(size > 0);
+
+            memcpy(buffer, r.c_str(), (size - 1) * sizeof(char_t));
+            buffer[size - 1] = 0;
+        }
 		
-		return size;
+		return full_size;
 	}
 
 	xpath_node_set xpath_query::evaluate_node_set(const xpath_node& n) const