{
size_t ret = 0;
- while (len > 0 && (str[0] || str[1])) {
+ while (len >= 2 && (str[0] || str[1])) {
str += 2;
ret += 2;
len -= 2;
char *p = data;
size_t plen;
- while (p < data + len && (plen = utf16_string_len_in_bytes (p)) > 0) {
+ while (p < data + len &&
+ (plen = utf16_string_len_in_bytes_max (p, data + len - p)) > 0) {
nr_strings++;
char **ret2 = realloc (ret, (1 + nr_strings) * sizeof (char *));
if (ret2 == NULL) {