I forgot to malloc space for the NULL.

-Erik

lash.c

@@ -936,7 +936,7 @@ char * strsep_space( char *string, int * index)
 		return NULL;
 	}
 
-	token = xmalloc(*index);
+	token = xmalloc(*index+1);
 	token[*index] = '\0';
 	strncpy(token, string,  *index); 
 

sh.c

@@ -936,7 +936,7 @@ char * strsep_space( char *string, int * index)
 		return NULL;
 	}
 
-	token = xmalloc(*index);
+	token = xmalloc(*index+1);
 	token[*index] = '\0';
 	strncpy(token, string,  *index); 
 

shell/lash.c

@@ -936,7 +936,7 @@ char * strsep_space( char *string, int * index)
 		return NULL;
 	}
 
-	token = xmalloc(*index);
+	token = xmalloc(*index+1);
 	token[*index] = '\0';
 	strncpy(token, string,  *index);