core: Avoid possible buffer overruns

In some circumstances we may pass -1 as len to g_strndup(), that
does not follow the "-1 means strlen()" convention. Do this
ourselves.

CIDs: #1530151, #1530152