diff --git a/src/or/buffers.c b/src/or/buffers.c
index 5e4c7d50c9..aac3294625 100644
--- a/src/or/buffers.c
+++ b/src/or/buffers.c
@@ -332,8 +332,7 @@ int fetch_from_buf(char *string, int string_len, buf_t *buf) {
  * the body are present, or b) there's no Content-Length field and
  * all headers are present, then:
  *   strdup headers into *headers_out, and nul-terminate it.
- *   memdup body into *body_out, and malloc one byte more than
- *   necessary, in case the caller wants to nul-terminate it.
+ *   memdup body into *body_out, and nul-terminate it.
  *   Then remove them from buf, and return 1.
  *
  *   If headers or body is NULL, discard that part of the buf.
@@ -395,7 +394,7 @@ int fetch_from_buf_http(buf_t *buf,
     *body_used = bodylen;
     *body_out = tor_malloc(bodylen+1);
     memcpy(*body_out,buf->mem+headerlen,bodylen);
-    /* don't null terminate it */
+    (*body_out)[bodylen] = 0; /* null terminate it */
   }
   buf_remove_from_front(buf, headerlen+bodylen);
   return 1;
diff --git a/src/or/directory.c b/src/or/directory.c
index ff565369ca..b83351beb1 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -211,8 +211,6 @@ int connection_dir_process_inbuf(connection_t *conn) {
 
     if(conn->purpose == DIR_PURPOSE_FETCH_DIR) {
       /* fetch/process the directory to learn about new routers. */
-      directory[dir_len] = 0; /* null terminate it, we can do this
-                                 because fetch_from_buf_http made space */
       log_fn(LOG_INFO,"Received directory (size %d):\n%s", dir_len, directory);
       if(status_code == 503 || dir_len == 0) {
         log_fn(LOG_INFO,"Empty directory. Ignoring.");
@@ -374,7 +372,6 @@ static int directory_handle_command_post(connection_t *conn,
   }
 
   if(!strcmp(url,"/")) { /* server descriptor post */
-    body[body_len] = 0; /* dirserv_add_descriptor expects nul-terminated */
     cp = body;
     switch(dirserv_add_descriptor(&cp)) {
       case -1: