you have to check len before accsessing "p".

In "Parse" function, "p" pointer is accessed before checking len parameter.
So, if we call doc->Parse(new byte [0], 0), tinyxml would crash due to segmentation fault.