[shadesandcolour]

It might be a slight typo, but I think that s23 is referring to the 3rd index in s2. Since the 4th character (or index 3 in a 0-index string), is the one that is causing the leak, this must be where the null character is.

[chigley]

That makes perfect sense, thank you!