The enclosed patch fixes the problem.

--- php-4.0.6/ext/xml/xml.c     Thu May 24 14:42:12 2001
+++ php-rnyberg/ext/xml/xml.c   Wed Aug 15 10:45:03 2001
@@ -494,14 +494,14 @@
        if (encoder == NULL) {
                /* If no encoder function was specified, return the data as-is.
                 */
-               newbuf = emalloc(len);
-               memcpy(newbuf, s, len);
+               newbuf = emalloc(len + 1);
+               memcpy(newbuf, s, len + 1);
                *newlen = len;
                return newbuf;
        }
        /* This is the theoretical max (will never get beyond len * 2 as long
         * as we are converting from single-byte characters, though) */
-       newbuf = emalloc(len * 4);
+       newbuf = emalloc(len * 4 + 1);
        while (pos > 0) {
                c = encoder ? encoder((unsigned char)(*s)) : (unsigned short)(*s);
                if (c < 0x80) {
@@ -522,9 +522,10 @@
                pos--;
                s++;
     }
-       if (*newlen < len * 4) {
-               newbuf = erealloc(newbuf, *newlen);
+       if (*newlen < len * 4 + 1) {
+               newbuf = erealloc(newbuf, *newlen + 1);
        }
+       newbuf[*newlen] = '\0';
        return newbuf;
 }
 /* }}} */