I don't see how wrapping it as a std::string or gcString would matter. It's a matter of getting the string from a size read or not. But I also don't see how a premature null termination in the XML can cause security issues.