diff --git a/libpromises/evalfunction.c b/libpromises/evalfunction.c
index 7707b18d0cb..01f1d455294 100644
--- a/libpromises/evalfunction.c
+++ b/libpromises/evalfunction.c
@@ -5193,7 +5193,7 @@ static FnCallResult FnCallFileStatDetails(ARG_UNUSED EvalContext *ctx,
                 }
 
                 char data[CF_BUFSIZE];
-                int datasize = lgetxattr(path, current, data, sizeof(data));
+                int datasize = lgetxattr(path, current, data, sizeof(data) - 1);
                 if (datasize < 0)
                 {
                     if (errno == ENOTSUP)
@@ -5208,6 +5208,8 @@ static FnCallResult FnCallFileStatDetails(ARG_UNUSED EvalContext *ctx,
                 }
                 else
                 {
+                  data[datasize] = '\0';
+
                   if (!StringIsPrintable(data))
                   {
                       Log(LOG_LEVEL_INFO, "Skipping extended attribute of '%s', it has non-printable data: '%s=%s'",