The terminating null byte for the C string result is written at
the index given by std::string.size() for the C++ string. It had
been written at one past that index.

WS_Release() must then ensure that the terminating null byte is
within the allocated portion of workspace.