Index: Objects/stringobject.c
===================================================================
--- Objects/stringobject.c	(revision 67412)
+++ Objects/stringobject.c	(working copy)
@@ -4,6 +4,7 @@
 
 #include "Python.h"
 #include <ctype.h>
+#include <stddef.h>
 
 #ifdef COUNT_ALLOCS
 int null_strings, one_strings;
@@ -80,7 +81,8 @@
 	}
 
 	/* Inline PyObject_NewVar */
-	op = (PyStringObject *)PyObject_MALLOC(sizeof(PyStringObject) + size);
+	op = (PyStringObject *)PyObject_MALLOC(
+		offsetof(PyStringObject, ob_sval) + size + 1);
 	if (op == NULL)
 		return PyErr_NoMemory();
 	PyObject_INIT_VAR(op, &PyString_Type, size);
@@ -135,7 +137,8 @@
 	}
 
 	/* Inline PyObject_NewVar */
-	op = (PyStringObject *)PyObject_MALLOC(sizeof(PyStringObject) + size);
+	op = (PyStringObject *)PyObject_MALLOC(
+		offsetof(PyStringObject, ob_sval) + size + 1);
 	if (op == NULL)
 		return PyErr_NoMemory();
 	PyObject_INIT_VAR(op, &PyString_Type, size);
@@ -999,7 +1002,8 @@
 				"strings are too large to concat");
 		return NULL;
 	}
-	op = (PyStringObject *)PyObject_MALLOC(sizeof(PyStringObject) + size);
+	op = (PyStringObject *)PyObject_MALLOC(
+		offsetof(PyStringObject, ob_sval) + size + 1);
 	if (op == NULL)
 		return PyErr_NoMemory();
 	PyObject_INIT_VAR(op, &PyString_Type, size);
@@ -1042,7 +1046,8 @@
 		return NULL;
 	}
 	op = (PyStringObject *)
-		PyObject_MALLOC(sizeof(PyStringObject) + nbytes);
+		PyObject_MALLOC(
+			offsetof(PyStringObject, ob_sval) + nbytes + 1);
 	if (op == NULL)
 		return PyErr_NoMemory();
 	PyObject_INIT_VAR(op, &PyString_Type, size);