Actually it does get null terminated, but one character too far... I guess we should add that bug too <g>
I don't get this on my w2k box... the string isn't null terminated, but there isn't no buffer overflow either which windows version did you test it on ?
A+