diff --git a/bstest.c b/bstest.c
index 3eca46b39ca00538f1fa8672b5ddf3f0e013933e_YnN0ZXN0LmM=..ec2e2969892422c1e4856310b98f9ae939eb3500_YnN0ZXN0LmM= 100644
--- a/bstest.c
+++ b/bstest.c
@@ -104,6 +104,7 @@
 
 #define EMPTY_STRING ""
 #define SHORT_STRING "bogus"
+#define EIGHT_CHAR_STRING "Waterloo"
 #define LONG_STRING  "This is a bogus but reasonably long string.  Just long enough to cause some mallocing."
 
 static int test0 (void) {
@@ -3363,7 +3364,7 @@
 }
 
 static int test46 (void) {
-bstring b;
+bstring b, b2;
 int ret = 0;
 
 	printf ("TEST: int bvcformata (bstring b, int count, const char * fmt, va_list arg);\n");
@@ -3395,6 +3396,16 @@
 	b->slen = 0;
 	ret += test46_1 (b, "%s", &longBstring, (char *) longBstring.data);
 
+	b->slen = 0;
+	b2 = bfromcstr (EIGHT_CHAR_STRING);
+	bconcat (b2, b2);
+	bconcat (b2, b2);
+	bconcat (b2, b2);
+	ret += test46_1 (b, "%s%s%s%s%s%s%s%s", b2,
+	                 EIGHT_CHAR_STRING, EIGHT_CHAR_STRING, EIGHT_CHAR_STRING, EIGHT_CHAR_STRING,
+	                 EIGHT_CHAR_STRING, EIGHT_CHAR_STRING, EIGHT_CHAR_STRING, EIGHT_CHAR_STRING);
+	bdestroy (b2);
+
 	bdestroy (b);
 	printf ("\t# failures: %d\n", ret);
 	return ret;
diff --git a/bstrlib.c b/bstrlib.c
index 3eca46b39ca00538f1fa8672b5ddf3f0e013933e_YnN0cmxpYi5j..ec2e2969892422c1e4856310b98f9ae939eb3500_YnN0cmxpYi5j 100644
--- a/bstrlib.c
+++ b/bstrlib.c
@@ -146,6 +146,12 @@
 		b->data = x;
 		b->mlen = len;
 		b->data[b->slen] = (unsigned char) '\0';
+
+#if defined (BSTRLIB_TEST_CANARY)
+		if (len > b->slen + 1) {
+			memchr (b->data + b->slen + 1, 'X', len - (b->slen + 1));
+		}
+#endif
 	}
 
 	return BSTR_OK;