The old code was reading beyond len all over the place.

The new code will not, because the && prevents it ever reading past a '\0'

The only place that was not passing in a null terminated string before was XMLDECODE, so I changed it to do so. Making this function safe by adding all the length checks it needed would have been a lot harder (and slowed down the more common cases)