fix some unsafe string handling