Logged In: YES 
user_id=34209

Hrm. After giving this some thought, perhaps we should do

 memcpy(buf, str, len+1)

instead of

 memcpy(buf, str, len)
 buf[len] = '\0'

(And do this in the writable-buffer case as well, when we
use memcpy.) Other than that, I think this is the right fix.
Assigning to mwh for second (third? fourth?) opinion.