diff --git a/mozilla/htmlparser/src/nsScanner.cpp b/mozilla/htmlparser/src/nsScanner.cpp
index f1a2033b1fa..daa37c26464 100644
--- a/mozilla/htmlparser/src/nsScanner.cpp
+++ b/mozilla/htmlparser/src/nsScanner.cpp
@@ -246,7 +246,7 @@ PRBool nsScanner::Append(const char* aBuffer, PRUint32 aLen){
   if(mUnicodeDecoder) {
     PRInt32 unicharBufLen = 0;
       mUnicodeDecoder->Length(aBuffer, 0, aLen, &unicharBufLen);
-      PRUnichar *unichars = new PRUnichar [ unicharBufLen ];
+      PRUnichar *unichars = new PRUnichar [ unicharBufLen+1 ];
 	  nsresult res;
 	  do {
 	    PRInt32 srcLength = aLen;
diff --git a/mozilla/parser/htmlparser/src/nsScanner.cpp b/mozilla/parser/htmlparser/src/nsScanner.cpp
index f1a2033b1fa..daa37c26464 100644
--- a/mozilla/parser/htmlparser/src/nsScanner.cpp
+++ b/mozilla/parser/htmlparser/src/nsScanner.cpp
@@ -246,7 +246,7 @@ PRBool nsScanner::Append(const char* aBuffer, PRUint32 aLen){
   if(mUnicodeDecoder) {
     PRInt32 unicharBufLen = 0;
       mUnicodeDecoder->Length(aBuffer, 0, aLen, &unicharBufLen);
-      PRUnichar *unichars = new PRUnichar [ unicharBufLen ];
+      PRUnichar *unichars = new PRUnichar [ unicharBufLen+1 ];
 	  nsresult res;
 	  do {
 	    PRInt32 srcLength = aLen;