Index: pjproject/trunk/pjlib-util/include/pjlib-util/cli.h
===================================================================
--- pjproject/trunk/pjlib-util/include/pjlib-util/cli.h	(revision 5696)
+++ pjproject/trunk/pjlib-util/include/pjlib-util/cli.h	(revision 5697)
@@ -401,4 +401,6 @@
  * register it to the CLI application.
  *
+ * Note that the input string MUST be NULL terminated.
+ *
  * @param cli		The CLI application.
  * @param group		Optional group to which this command will be added
@@ -406,5 +408,5 @@
  * 			command.
  * @param xml		Input string containing XML node text for the
- * 			command.
+ * 			command, MUST be NULL terminated.
  * @param handler	Function handler for the command. This must be NULL
  * 			if the command specifies a command group.
Index: pjproject/trunk/pjlib-util/include/pjlib-util/xml.h
===================================================================
--- pjproject/trunk/pjlib-util/include/pjlib-util/xml.h	(revision 5696)
+++ pjproject/trunk/pjlib-util/include/pjlib-util/xml.h	(revision 5697)
@@ -74,7 +74,10 @@
  * be included in the resulted XML node tree.
  *
+ * Note that the XML message input buffer MUST be NULL terminated and have
+ * length at least len+1 (len MUST NOT include the NULL terminator).
+ *
  * @param pool	    Pool to allocate memory from.
- * @param msg	    The XML message to parse.
- * @param len	    The length of the message.
+ * @param msg	    The XML message to parse, MUST be NULL terminated.
+ * @param len	    The length of the message, not including NULL terminator.
  *
  * @return	    XML root node, or NULL if the XML document can not be parsed.
Index: pjproject/trunk/pjlib-util/src/pjlib-util/cli.c
===================================================================
--- pjproject/trunk/pjlib-util/src/pjlib-util/cli.c	(revision 5696)
+++ pjproject/trunk/pjlib-util/src/pjlib-util/cli.c	(revision 5697)
@@ -695,4 +695,7 @@
             PJ_USE_EXCEPTION;
 
+	    /* The buffer passed to the scanner is not NULL terminated,
+	     * but should be safe. See ticket #2063.
+	     */
             pj_scan_init(&scanner, attr->value.ptr, attr->value.slen,
                          PJ_SCAN_AUTOSKIP_WS, &on_syntax_error);
@@ -723,5 +726,7 @@
             }
             PJ_END;
-            
+
+            pj_scan_fini(&scanner);
+
         } else if (!pj_stricmp2(&attr->name, "desc")) {
             pj_strdup(cli->pool, &cmd->desc, &attr->value);
@@ -861,5 +866,7 @@
     pj_cli_exec_info_default(info);
 
-    /* Set the parse mode based on the latest char. */
+    /* Set the parse mode based on the latest char.
+     * And NULL terminate the buffer for the scanner.
+     */
     len = pj_ansi_strlen(cmdline);
     if (len > 0 && ((cmdline[len - 1] == '\r')||(cmdline[len - 1] == '\n'))) {
@@ -931,4 +938,6 @@
 	}
 	PJ_END;
+	
+	pj_scan_fini(&scanner);
     } 
     
Index: pjproject/trunk/pjlib-util/src/pjlib-util/cli_telnet.c
===================================================================
--- pjproject/trunk/pjlib-util/src/pjlib-util/cli_telnet.c	(revision 5696)
+++ pjproject/trunk/pjlib-util/src/pjlib-util/cli_telnet.c	(revision 5697)
@@ -972,4 +972,6 @@
     }
     PJ_END;
+    
+    pj_scan_fini(&scanner);
     return PJ_SUCCESS;
 }
@@ -1333,4 +1335,5 @@
     PJ_END;
 
+    pj_scan_fini(&scanner);
     return PJ_SUCCESS;
 }
Index: pjproject/trunk/pjlib-util/src/pjlib-util/scanner.c
===================================================================
--- pjproject/trunk/pjlib-util/src/pjlib-util/scanner.c	(revision 5696)
+++ pjproject/trunk/pjlib-util/src/pjlib-util/scanner.c	(revision 5697)
@@ -128,9 +128,4 @@
     scanner->skip_ws = options;
 
-    /* Buffer validation. Must be NULL terminated.
-     * See ticket #2063.
-     */
-    // pj_assert(*(scanner->end) == 0);
-
     if (scanner->skip_ws) 
 	pj_scan_skip_whitespace(scanner);
Index: pjproject/trunk/pjmedia/include/pjmedia/sdp.h
===================================================================
--- pjproject/trunk/pjmedia/include/pjmedia/sdp.h	(revision 5696)
+++ pjproject/trunk/pjmedia/include/pjmedia/sdp.h	(revision 5697)
@@ -646,7 +646,10 @@
  * Parse SDP message.
  *
+ * Note that the input message buffer MUST be NULL terminated and have
+ * length at least len+1 (len MUST NOT include the NULL terminator).
+ *
  * @param pool	    The pool to allocate SDP session description.
- * @param buf	    The message buffer.
- * @param len	    The length of the message.
+ * @param buf	    The message buffer, MUST be NULL terminated.
+ * @param len	    The length of the message, excluding NULL terminator.
  * @param p_sdp	    Pointer to receive the SDP session descriptor.
  *
Index: pjproject/trunk/pjmedia/src/pjmedia/sdp.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/sdp.c	(revision 5696)
+++ pjproject/trunk/pjmedia/src/pjmedia/sdp.c	(revision 5697)
@@ -276,4 +276,7 @@
     }
 
+    /* The buffer passed to the scanner is not guaranteed to be NULL
+     * terminated, but should be safe. See ticket #2063.
+     */    
     pj_scan_init(&scanner, (char*)attr->value.ptr, attr->value.slen,
 		 PJ_SCAN_AUTOSKIP_WS, &on_scanner_error);
@@ -386,4 +389,7 @@
      */
 
+    /* The buffer passed to the scanner is not guaranteed to be NULL
+     * terminated, but should be safe. See ticket #2063.
+     */
     pj_scan_init(&scanner, (char*)attr->value.ptr, attr->value.slen,
 		 PJ_SCAN_AUTOSKIP_WS, &on_scanner_error);
Index: pjproject/trunk/pjsip/include/pjsip-simple/iscomposing.h
===================================================================
--- pjproject/trunk/pjsip/include/pjsip-simple/iscomposing.h	(revision 5696)
+++ pjproject/trunk/pjsip/include/pjsip-simple/iscomposing.h	(revision 5697)
@@ -105,7 +105,10 @@
  * message.
  *
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least len+1 (len MUST NOT include the NULL terminator).
+ *
  * @param pool		    Pool to allocate memory for the parsing process.
- * @param msg		    The message to be parsed.
- * @param len		    Length of the message.
+ * @param msg		    The message to be parsed, MUST be NULL terminated.
+ * @param len		    Length of the message, excluding NULL terminator.
  * @param p_is_composing    Optional pointer to receive iscomposing status.
  * @param p_last_active	    Optional pointer to receive last active attribute.
Index: pjproject/trunk/pjsip/include/pjsip-simple/xpidf.h
===================================================================
--- pjproject/trunk/pjsip/include/pjsip-simple/xpidf.h	(revision 5696)
+++ pjproject/trunk/pjsip/include/pjsip-simple/xpidf.h	(revision 5697)
@@ -61,7 +61,10 @@
  * Parse XPIDF document.
  *
+ * Note that the input text buffer MUST be NULL terminated and have
+ * length at least len+1 (len MUST NOT include the NULL terminator).
+ *
  * @param pool	    Pool.
- * @param text	    Input text.
- * @param len	    Length of input text.
+ * @param text	    Input text, MUST be NULL terminated.
+ * @param len	    Length of input text, NOT including the NULL terminator.
  *
  * @return	    XPIDF document.
Index: pjproject/trunk/pjsip/include/pjsip/sip_parser.h
===================================================================
--- pjproject/trunk/pjsip/include/pjsip/sip_parser.h	(revision 5696)
+++ pjproject/trunk/pjsip/include/pjsip/sip_parser.h	(revision 5697)
@@ -280,8 +280,9 @@
  * Check incoming packet to see if a (probably) valid SIP message has been 
  * received.
- * Note that the input string buffer MUST be NULL terminated.
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
  *
  * @param buf		The input buffer, which must be NULL terminated.
- * @param size		The buffer size.
+ * @param size		The length of the string (not counting NULL terminator).
  * @param is_datagram	Put non-zero if transport is datagram oriented.
  * @param msg_size	[out] If message is valid, this parameter will contain
Index: pjproject/trunk/pjsip/src/pjsip/sip_parser.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_parser.c	(revision 5696)
+++ pjproject/trunk/pjsip/src/pjsip/sip_parser.c	(revision 5697)
@@ -878,4 +878,7 @@
 	    PJ_USE_EXCEPTION;
 
+	    /* The buffer passed to the scanner is not NULL terminated,
+             * but should be safe. See ticket #2063.
+	     */ 
 	    pj_scan_init(&scanner, (char*)line, hdr_end-line, 
 			 PJ_SCAN_AUTOSKIP_WS_HEADER, &on_syntax_error);
