The function reads resource content into a buffer whose size matches the size of the file contents. This buffer does not have an extra byte that would 0 terminate this string. This is by itself is not a problem. Unfortunately the buffer is passed to g_utf8_make_valid function with size argument specified as -1 which means the buffer is supposed to be NULL terminated. The end result is g_utf8_make_valid will read at least 1 byte past "contents" buffer size.
Fix this by specifying buffer size when calling g_utf8_make_valid.