diff --git a/gcc/fortran/data.c b/gcc/fortran/data.c
index 2ab6f507bbeb..d53f92c4e209 100644
--- a/gcc/fortran/data.c
+++ b/gcc/fortran/data.c
@@ -155,7 +155,8 @@ create_character_intializer (gfc_expr * init, gfc_typespec * ts,
       init->expr_type = EXPR_CONSTANT;
       init->ts = *ts;
       
-      dest = gfc_getmem (len);
+      dest = gfc_getmem (len + 1);
+      dest[len] = '\0';
       init->value.character.length = len;
       init->value.character.string = dest;
       /* Blank the string if we're only setting a substring.  */
diff --git a/gcc/fortran/decl.c b/gcc/fortran/decl.c
index e17e9e3436d4..84797b7fdc09 100644
--- a/gcc/fortran/decl.c
+++ b/gcc/fortran/decl.c
@@ -754,10 +754,11 @@ gfc_set_constant_character_len (int len, gfc_expr * expr)
   slen = expr->value.character.length;
   if (len != slen)
     {
-      s = gfc_getmem (len);
+      s = gfc_getmem (len + 1);
       memcpy (s, expr->value.character.string, MIN (len, slen));
       if (len > slen)
 	memset (&s[slen], ' ', len - slen);
+      s[len] = '\0';
       gfc_free (expr->value.character.string);
       expr->value.character.string = s;
       expr->value.character.length = len;
diff --git a/gcc/fortran/expr.c b/gcc/fortran/expr.c
index 1f51fd09fca5..d2da0d845c35 100644
--- a/gcc/fortran/expr.c
+++ b/gcc/fortran/expr.c
@@ -1438,7 +1438,7 @@ gfc_simplify_expr (gfc_expr * p, int type)
 	  gfc_extract_int (p->ref->u.ss.end, &end);
 	  s = gfc_getmem (end - start + 1);
 	  memcpy (s, p->value.character.string + start, end - start);
-	  s[end] = '\0';  /* TODO: C-style string for debugging.  */
+	  s[end-start+1] = '\0';  /* TODO: C-style string for debugging.  */
 	  gfc_free (p->value.character.string);
 	  p->value.character.string = s;
 	  p->value.character.length = end - start;
diff --git a/gcc/fortran/primary.c b/gcc/fortran/primary.c
index 1dd8626d5cf5..9982b614208e 100644
--- a/gcc/fortran/primary.c
+++ b/gcc/fortran/primary.c
@@ -281,6 +281,7 @@ match_hollerith_constant (gfc_expr ** result)
 		gfc_default_character_kind, &gfc_current_locus);
 	  e->value.character.string = gfc_getmem (num+1);
 	  memcpy (e->value.character.string, buffer, num);
+	  e->value.character.string[num] = '\0';
 	  e->value.character.length = num;
 	  *result = e;
 	  return MATCH_YES;
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 28d64cba463e..53ed75805225 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2006-10-31  Francois-Xavier Coudert  <coudert@clipper.ens.fr>
+
+	PR fortran/29067
+	* gfortran.dg/pr29067.f: New test.
+
 2006-10-31  Joseph Myers  <joseph@codesourcery.com>
             Richard Sandiford  <richard@codesourcery.com>
 
diff --git a/gcc/testsuite/gfortran.dg/pr29067.f b/gcc/testsuite/gfortran.dg/pr29067.f
new file mode 100644
index 000000000000..516711480026
--- /dev/null
+++ b/gcc/testsuite/gfortran.dg/pr29067.f
@@ -0,0 +1,18 @@
+      ! { dg-do compile }
+      ! PR fortran/29067
+      implicit none
+      integer :: n, i
+      character(len=16),parameter :: s = "", s2 = "1234567890123456"
+
+      i = 0 ; n = 9
+      print *, s(9:16)
+      print *, s2(9:16)
+      if (s(9:16) == "90123456") then
+      endif
+      if (i > 0) then
+        write (i,*) n
+        call foo(0)
+      endif
+      do i = 1, n
+      end do
+      end