diff --git a/ChangeLog b/ChangeLog
index b8308d2fa..85fa7dd00 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2010-05-29  Richard Frith-Macdonald <rfm@gnu.org>
+
+	* NSConcreteHashTable.m:
+	* NSHashTable.m: In ([-allObjects]) fix buffer overrun (bug #29980).
+	* Source/NSXMLParser.m: Fix off-by-one error handling whitespace.
+	* Headers/Additions/GNUstepBase/GSMime.h: Revert xml charset method.
+	* Source/NSURL.m: Allow a URL made from an empty string (OSX compat).
+
 2010-05-28  Quentin Mathe <quentin.mathe@gmail.com>
 
 	* Source/NSKeyValueCoding.m: Added missing support to ValueForKey() as 
diff --git a/Headers/Additions/GNUstepBase/GSMime.h b/Headers/Additions/GNUstepBase/GSMime.h
index 2a2842c09..6212fceb8 100644
--- a/Headers/Additions/GNUstepBase/GSMime.h
+++ b/Headers/Additions/GNUstepBase/GSMime.h
@@ -119,7 +119,6 @@ extern "C" {
 #endif
 }
 
-+ (NSString*) charsetForXml: (NSData*)xml;
 + (NSString*) charsetFromEncoding: (NSStringEncoding)enc;
 
 /**
diff --git a/Source/Additions/GSMime.m b/Source/Additions/GSMime.m
index 48a9e3052..05d298d8e 100644
--- a/Source/Additions/GSMime.m
+++ b/Source/Additions/GSMime.m
@@ -3822,6 +3822,7 @@ appendString(NSMutableData *m, NSUInteger offset, NSUInteger fold,
   unsigned char	*dst;
   unsigned char	buf[4];
   NSUInteger	pos = 0;
+  int		pad = 0;
 
   if (source == nil)
     {
@@ -3870,6 +3871,7 @@ appendString(NSMutableData *m, NSUInteger offset, NSUInteger fold,
       else if  (c == '=')
 	{
 	  c = -1;
+	  pad++;
 	}
       else if (c == '-')
 	{
@@ -3895,19 +3897,15 @@ appendString(NSMutableData *m, NSUInteger offset, NSUInteger fold,
   if (pos > 0)
     {
       NSUInteger	i;
+      unsigned char	tail[3];
 
       for (i = pos; i < 4; i++)
 	{
 	  buf[i] = '\0';
 	}
-      pos--;
-      if (pos > 0)
-	{
-	  unsigned char	tail[3];
-	  decodebase64(tail, buf);
-	  memcpy(dst, tail, pos);
-	  dst += pos;
-	}
+      decodebase64(tail, buf);
+      memcpy(dst, tail, 3 - pad);
+      dst += 3 - pad;
     }
   return AUTORELEASE([[NSData allocWithZone: NSDefaultMallocZone()]
     initWithBytesNoCopy: result length: dst - result]);
diff --git a/Source/NSConcreteHashTable.m b/Source/NSConcreteHashTable.m
index 8fc886b4b..bf255273b 100644
--- a/Source/NSConcreteHashTable.m
+++ b/Source/NSConcreteHashTable.m
@@ -861,12 +861,13 @@ const NSHashTableCallBacks NSPointerToStructHashCallBacks =
 
   enumerator = NSEnumerateHashTable(self);
   index = 0;
-  while ((objects[index] = NSNextHashEnumeratorItem(&enumerator)) != nil)
+  while (index < nodeCount
+    && (objects[index] = NSNextHashEnumeratorItem(&enumerator)) != nil)
     {
       index++;
     }
   NSEndHashTableEnumeration(&enumerator);
-  a = [[[NSArray alloc] initWithObjects: objects count: nodeCount] autorelease];
+  a = [[[NSArray alloc] initWithObjects: objects count: index] autorelease];
   GS_ENDITEMBUF();
   return a;
 }
diff --git a/Source/NSHashTable.m b/Source/NSHashTable.m
index 5b44a6b0a..cfab7783f 100644
--- a/Source/NSHashTable.m
+++ b/Source/NSHashTable.m
@@ -112,11 +112,11 @@ static Class	concreteClass = 0;
 
   enumerator = [self objectEnumerator];
   index = 0;
-  while ((objects[index] = [enumerator nextObject]) != nil)
+  while (index < nodeCount && (objects[index] = [enumerator nextObject]) != nil)
     {
       index++;
     }
-  a = [[[NSArray alloc] initWithObjects: objects count: nodeCount] autorelease];
+  a = [[[NSArray alloc] initWithObjects: objects count: index] autorelease];
   GS_ENDITEMBUF();
   return a;
 }
diff --git a/Source/NSURL.m b/Source/NSURL.m
index 83358e99f..8f2b0ba27 100644
--- a/Source/NSURL.m
+++ b/Source/NSURL.m
@@ -662,6 +662,7 @@ static unsigned	urlAlign;
  * may be nil, but aUrlString must be non-nil.<br />
  * Accepts RFC2732 style IPv6 host addresses.<br />
  * Parses a string wihthout a scheme as a simple path.<br />
+ * Parses an empty string as an empty path.<br />
  * If the string cannot be parsed the method returns nil.
  */
 - (id) initWithString: (NSString*)aUrlString
@@ -685,11 +686,6 @@ static unsigned	urlAlign;
 		  format: @"[%@ %@] bad base URL parameter",
 	NSStringFromClass([self class]), NSStringFromSelector(_cmd)];
     }
-  if ([aUrlString length] == 0)
-    {
-      DESTROY(self);
-      return nil;
-    }
   ASSIGNCOPY(_urlString, aUrlString);
   ASSIGN(_baseURL, [aBaseUrl absoluteURL]);
   NS_DURING
diff --git a/Source/NSXMLParser.m b/Source/NSXMLParser.m
index b48171090..133ebec16 100644
--- a/Source/NSXMLParser.m
+++ b/Source/NSXMLParser.m
@@ -38,6 +38,10 @@
 #import "GNUstepBase/NSObject+GNUstepBase.h"
 #import "GNUstepBase/GSMime.h"
 
+@interface GSMimeDocument (internal)
++ (NSString*) charsetForXml: (NSData*)xml;
+@end
+
 NSString* const NSXMLParserErrorDomain = @"NSXMLParserErrorDomain";
 
 static  NSNull  *null = nil;
@@ -1357,7 +1361,7 @@ NSLog(@"_processTag <%@%@ %@>", flag?@"/": @"", tag, attributes);
 			  foundIgnorableSel, self, s);
 			[s release];
 		      }
-		    vp = this->cp;
+		    vp = this->cp - 1;
 		  }
 		/* We have read non-space data, so whitespace is no longer
 		 * ignorable, and the buffer no loinger contains only space.