diff --git a/src/anchor.c b/src/anchor.c
index 17a17138..1a9b640a 100644
--- a/src/anchor.c
+++ b/src/anchor.c
@@ -1118,7 +1118,8 @@ static void tas_read_cb(void *userarg)
 		}
 		if (doc_len > 0) {
 			uint8_t *doc = GETDNS_XMALLOC(
-			    context->mf, uint8_t, doc_len);
+			    context->mf, uint8_t, doc_len + 1);
+			doc[doc_len] = 0;
 
 			DEBUG_ANCHOR("i: %d, n: %d, doc_len: %d\n"
 			            , (int)i, (int)n, doc_len);
diff --git a/src/context.c b/src/context.c
index 668cf6b5..4c78368b 100644
--- a/src/context.c
+++ b/src/context.c
@@ -4539,8 +4539,8 @@ uint8_t *_getdns_context_get_priv_file(getdns_context *context,
 	if (!(f = fopen(path, "r")))
 		return NULL;
 
-	if ((*file_sz = fread(buf, 1, buf_len, f)) < buf_len && feof(f))
-		; /* pass */
+	if ((*file_sz = fread(buf, 1, buf_len, f)) < (buf_len  - 1) && feof(f))
+		buf[*file_sz] = 0;
 
 	else if (fseek(f, 0, SEEK_END) < 0)
 		buf = NULL;
@@ -4553,6 +4553,7 @@ uint8_t *_getdns_context_get_priv_file(getdns_context *context,
 			GETDNS_FREE(context->mf, buf);
 			buf = NULL;
 		}
+		buf[*file_sz] = 0;
 	}
 	(void) fclose(f);
 	return buf;
diff --git a/src/test/tpkg/100-compile.tpkg/100-compile.pre b/src/test/tpkg/100-compile.tpkg/100-compile.pre
index 6b76edba..ea1cacee 100644
--- a/src/test/tpkg/100-compile.tpkg/100-compile.pre
+++ b/src/test/tpkg/100-compile.tpkg/100-compile.pre
@@ -25,4 +25,4 @@ done
 rm -fr "${BUILDDIR}/build"
 mkdir  "${BUILDDIR}/build"
 cd "${BUILDDIR}/build"
-"${SRCROOT}/configure" $* --prefix "${BUILDDIR}/install"
+"${SRCROOT}/configure" $* --prefix "${BUILDDIR}/install" --enable-debug-anchor