diff --git a/src/librustdoc/html/markdown.rs b/src/librustdoc/html/markdown.rs
index 03da451fd9a..cd58ff3109f 100644
--- a/src/librustdoc/html/markdown.rs
+++ b/src/librustdoc/html/markdown.rs
@@ -32,7 +32,6 @@
 use std::cell::RefCell;
 use std::collections::{HashMap, VecDeque};
 use std::default::Default;
-use std::ffi::CString;
 use std::fmt::{self, Write};
 use std::str;
 use syntax::feature_gate::UnstableFeatures;
@@ -531,6 +530,7 @@ fn hoedown_document_render(doc: *mut hoedown_document,
     fn hoedown_buffer_new(unit: libc::size_t) -> *mut hoedown_buffer;
     fn hoedown_buffer_puts(b: *mut hoedown_buffer, c: *const libc::c_char);
     fn hoedown_buffer_free(b: *mut hoedown_buffer);
+    fn hoedown_buffer_put(b: *mut hoedown_buffer, c: *const libc::c_char, len: libc::size_t);
 }
 
 impl hoedown_buffer {
@@ -620,8 +620,7 @@ fn dont_escape(c: u8) -> bool {
                                Some("rust-example-rendered"),
                                None,
                                playground_button.as_ref().map(String::as_str)));
-                let output = CString::new(s).unwrap();
-                hoedown_buffer_puts(ob, output.as_ptr());
+                hoedown_buffer_put(ob, s.as_ptr() as *const libc::c_char, s.len());
             })
         }
     }
@@ -681,8 +680,7 @@ fn dont_escape(c: u8) -> bool {
                            <a href='#{id}'>{sec}{}</a></h{lvl}>",
                            s, lvl = level, id = id, sec = sec);
 
-        let text = CString::new(text).unwrap();
-        unsafe { hoedown_buffer_puts(ob, text.as_ptr()) }
+        unsafe { hoedown_buffer_put(ob, text.as_ptr() as *const libc::c_char, text.len()); }
     }
 
     extern fn codespan(
@@ -699,9 +697,10 @@ fn dont_escape(c: u8) -> bool {
             collapse_whitespace(s)
         };
 
-        let content = format!("<code>{}</code>", Escape(&content));
-        let element = CString::new(content).unwrap();
-        unsafe { hoedown_buffer_puts(ob, element.as_ptr()); }
+        let content = format!("<code>{}</code>", Escape(&content)).replace("\0", "\\0");
+        unsafe {
+            hoedown_buffer_put(ob, content.as_ptr() as *const libc::c_char, content.len());
+        }
         // Return anything except 0, which would mean "also print the code span verbatim".
         1
     }
diff --git a/src/test/rustdoc/nul-error.rs b/src/test/rustdoc/nul-error.rs
new file mode 100644
index 00000000000..f20d19d0e59
--- /dev/null
+++ b/src/test/rustdoc/nul-error.rs
@@ -0,0 +1,18 @@
+// Copyright 2017 The Rust Project Developers. See the COPYRIGHT
+// file at the top-level directory of this distribution and at
+// http://rust-lang.org/COPYRIGHT.
+//
+// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
+// http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
+// option. This file may not be copied, modified, or distributed
+// except according to those terms.
+
+// build-aux-docs
+// ignore-cross-compile
+
+#![crate_name = "foo"]
+
+// @has foo/fn.foo.html '//code' '0'
+#[doc = "Attempted to pass a string containing `\0`"]
+pub fn foo() {}