terminate the destination string in M_StringReplace()

fixes #428