Index: pjproject/trunk/pjlib-util/include/pjlib-util/scanner.h
===================================================================
--- pjproject/trunk/pjlib-util/include/pjlib-util/scanner.h	(revision 5692)
+++ pjproject/trunk/pjlib-util/include/pjlib-util/scanner.h	(revision 5693)
@@ -217,14 +217,12 @@
 
 /**
- * Initialize the scanner. Note that the input string buffer must have
- * length at least buflen+1 because the scanner will NULL terminate the
- * string during initialization.
+ * Initialize the scanner.
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least buflen+1 (buflen MUST NOT include the NULL terminator).
  *
  * @param scanner   The scanner to be initialized.
- * @param bufstart  The input buffer to scan. Note that buffer[buflen] will be 
- *		    filled with NULL char until scanner is destroyed, so
- *		    the actual buffer length must be at least buflen+1.
+ * @param bufstart  The input buffer to scan, which must be NULL terminated.
  * @param buflen    The length of the input buffer, which normally is
- *		    strlen(bufstart).
+ *		    strlen(bufstart), hence not counting the NULL terminator.
  * @param options   Zero, or combination of PJ_SCAN_AUTOSKIP_WS or
  *		    PJ_SCAN_AUTOSKIP_WS_HEADER
Index: pjproject/trunk/pjlib-util/src/pjlib-util/scanner.c
===================================================================
--- pjproject/trunk/pjlib-util/src/pjlib-util/scanner.c	(revision 5692)
+++ pjproject/trunk/pjlib-util/src/pjlib-util/scanner.c	(revision 5693)
@@ -23,6 +23,9 @@
 #include <pj/except.h>
 #include <pj/os.h>
+#include <pj/log.h>
 #include <pj/errno.h>
 #include <pj/assert.h>
+
+#define THIS_FILE   "scanner.c"
 
 #define PJ_SCAN_IS_SPACE(c)		((c)==' ' || (c)=='\t')
@@ -117,4 +120,9 @@
 {
     PJ_CHECK_STACK();
+
+    /* Buffer validation. Must be NULL terminated.
+     * See ticket #2063.
+     */
+    pj_assert(*scanner->end == 0);
 
     scanner->begin = scanner->curptr = bufstart;
Index: pjproject/trunk/pjsip/include/pjsip/sip_parser.h
===================================================================
--- pjproject/trunk/pjsip/include/pjsip/sip_parser.h	(revision 5692)
+++ pjproject/trunk/pjsip/include/pjsip/sip_parser.h	(revision 5693)
@@ -197,4 +197,6 @@
 /**
  * Parse an URI in the input and return the correct instance of URI.
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
  *
  * @param pool		The pool to get memory allocations.
@@ -217,4 +219,6 @@
 /**
  * Parse SIP status line.
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
  *
  * @param buf		Text buffer to parse, which MUST be NULL terminated.
@@ -235,4 +239,7 @@
  * of the body.
  *
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
+ *
  * @param pool		The pool to allocate memory.
  * @param buf		The input buffer, which MUST be NULL terminated.
@@ -257,4 +264,7 @@
  * This function is normally called by the transport layer.
  *
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
+ *
  * @param buf		The input buffer, which MUST be NULL terminated.
  * @param size		The length of the string (not counting NULL terminator).
@@ -270,4 +280,5 @@
  * Check incoming packet to see if a (probably) valid SIP message has been 
  * received.
+ * Note that the input string buffer MUST be NULL terminated.
  *
  * @param buf		The input buffer, which must be NULL terminated.
@@ -288,4 +299,7 @@
  * This function parses the content of a header (ie. part after colon) according
  * to the expected name, and will return the correct instance of header.
+ *
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator). 
  *
  * @param pool		Pool to allocate memory for the header.
@@ -315,7 +329,10 @@
  * is optional for the last header.
  *
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
+ *
  * @param pool		The pool.
  * @param input		The input text to parse, which must be NULL terminated.
- * @param size		The text length.
+ * @param size		The text length (not counting NULL terminator).
  * @param hlist		The header list to store the parsed headers.
  *			This list must have been initialized before calling 
Index: pjproject/trunk/pjsip/src/pjsip/sip_multipart.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_multipart.c	(revision 5692)
+++ pjproject/trunk/pjsip/src/pjsip/sip_multipart.c	(revision 5693)
@@ -663,5 +663,5 @@
 	    if (*(end_body-1) == '\n')
 	        --end_body;
-	    if (*(end_body-1) == '\r')
+	    if (end_body > start_body && *(end_body-1) == '\r')
 	        --end_body;
         }
