so buf is a NULL terminated xml char array. Mhh this could cause security problems, because parsing a xml is triggered from the outside (internet).