Index: src/libchcore/TString.cpp
===================================================================
diff -u -N -r633a533cb6e741d44fe28aa56339e1d2709b1b27 -r3bc27cd61d57077aba80189b2fdde1500a2367a4
--- src/libchcore/TString.cpp	(.../TString.cpp)	(revision 633a533cb6e741d44fe28aa56339e1d2709b1b27)
+++ src/libchcore/TString.cpp	(.../TString.cpp)	(revision 3bc27cd61d57077aba80189b2fdde1500a2367a4)
@@ -453,6 +453,7 @@
 
 	EnsureWritable(1);
 	wmemmove(m_pszStringData + stIndex, m_pszStringData + stIndex + 1, stCurrentLength - stIndex);
+	m_pszStringData[stCurrentLength - 1] = _T('\0');
 	GetInternalStringData()->SetStringLength(stCurrentLength - 1);
 }
 
@@ -466,7 +467,9 @@
 
 	size_t stCountToDelete = min(stCurrentLength - stIndex, stCount);
 
-	wmemmove(m_pszStringData + stIndex, m_pszStringData + stIndex + stCountToDelete, stCountToDelete);
+	wmemmove(m_pszStringData + stIndex, m_pszStringData + stIndex + stCountToDelete, stCurrentLength - stCountToDelete);
+	m_pszStringData[stCurrentLength - stCountToDelete] = _T('\0');
+
 	GetInternalStringData()->SetStringLength(stCurrentLength - stCountToDelete);
 }
 
@@ -717,7 +720,10 @@
 	{
 		EnsureWritable(stCount + 1);
 
-		wcsncpy_s(m_pszStringData, GetCurrentBufferSize() - 1, pszStart, stCount);
+		size_t stMaxBufSize = GetCurrentBufferSize();
+		BOOST_ASSERT(stCount + 1 <= stMaxBufSize);
+
+		wcsncpy_s(m_pszStringData, stMaxBufSize, pszStart, stCount);
 		m_pszStringData[stCount] = _T('\0');
 		GetInternalStringData()->SetStringLength(stCount);
 	}