Null-terminate some buffers and fix a write-after-free

r? @frank-trampe
I think it was a bad copy-paste or something... `cur->where` should be populated before the actual processing, `MergeDStemInfo()`, happens (this function can free `cur` if the merge, this is how I tracked the bug).