@@ -124,11 +124,11 @@
 	char *str_c;
 	size_t len, i, j, attrs_count;
 	OFXMLAttribute **attrs_carray;
 	OFString *ret, *tmp;
 
-	len = [name cStringLength] + 4;
+	len = [name cStringLength] + 3;
 	str_c = [self allocMemoryWithSize: len];
 
 	/* Start of tag */
 	*str_c = '<';
 	memcpy(str_c + 1, [name cString], [name cStringLength]);
@@ -202,21 +202,20 @@
 		i += [name cStringLength];
 	} else
 		str_c[i++] = '/';
 
 	str_c[i++] = '>';
-	str_c[i++] = '\0';
 	assert(i == len);
 
 	[pool release];
 
 	@try {
-		ret = [OFString stringWithCString: str_c];
+		ret = [OFString stringWithCString: str_c
+					   length: len];
 	} @finally {
 		[self freeMemory: str_c];
 	}
-
 	return ret;
 }
 
 - addAttribute: (OFXMLAttribute*)attr
 {
@@ -278,16 +277,16 @@
 	size_t len, append_len;
 	size_t i, j;
 	OFString *ret;
 
 	j = 0;
-	len = length + 1;
+	len = length;
 
 	/*
 	 * We can't use allocMemoryWithSize: here as it might be a @"" literal
 	 */
-	if ((str_c = malloc(len + 1)) == NULL)
+	if ((str_c = malloc(len)) == NULL)
 		@throw [OFOutOfMemoryException newWithClass: isa
 						       size: len];
 
 	for (i = 0; i < length; i++) {
 		switch (string[i]) {
@@ -330,17 +329,16 @@
 			j += append_len;
 		} else
 			str_c[j++] = string[i];
 	}
 
-	str_c[j++] = '\0';
 	assert(j == len);
 
 	@try {
-		ret = [OFString stringWithCString: str_c];
+		ret = [OFString stringWithCString: str_c
+					   length: len];
 	} @finally {
 		free(str_c);
 	}
-
 	return ret;
 }
 @end