The null byte wasn't taken into account when allocating memory to strcpy into. The calculation to check if allocation was needed was also wrong, causing allocation for every string. In practice it's not so likely users would ever hit this since the function tended to over allocate, even in the case an off by one error occurred, in all likelihood the room would already be available. Ref !114512