You should probably reset `buf->c` before you set new `len` otherwise `null` can be written after the new `buf->len`. It should be something like
```
buf->c -= oldlen - buf->len;
buf->len = oldlend;
```
It would be good to add some tests for it to check if it generates the same output when there is ill-formed utf8