--- subst.c
+++ subst.c	2006-05-31 16:59:58.000000000 +0000
@@ -946,8 +946,9 @@
 		  len = mbstowcs (wcharlist, charlist, 0);
 		  if (len == -1)
 		    len = 0;
-		  wcharlist = xmalloc ((sizeof (wchar_t) * len) + 1);
+		  wcharlist = xmalloc ((sizeof (wchar_t)) * (len + 1));
 		  mbstowcs (wcharlist, charlist, len);
+		  wcharlist[len] = (wchar_t)0;
 		}
 
 	      if (wcschr (wcharlist, wc))