diff --git a/libutils/json.c b/libutils/json.c
index f54d4ca1..42f41263 100644
--- a/libutils/json.c
+++ b/libutils/json.c
@@ -1043,7 +1043,8 @@ static bool HexStringToChar(const char *hex_string, char *res)
         return false;
     }
 
-    char tmp[hex_len + 1];
+    char *tmp;
+    tmp = alloca(hex_len + 1);
     memcpy(tmp, hex_string, hex_len);
     tmp[hex_len] = '\0';
 
diff --git a/libutils/string_lib.c b/libutils/string_lib.c
index 9de4f969..5bf3c79c 100644
--- a/libutils/string_lib.c
+++ b/libutils/string_lib.c
@@ -418,9 +418,9 @@ char *StringSubstring(const char *source, size_t source_len, int start, int len)
         start = source_len + start;
     }
 
-    if (start >= end)
+    if (start > end)
     {
-        return NULL;
+        return SafeStringDuplicate("");
     }
 
     char *result = xcalloc(end - start + 2, sizeof(char));
diff --git a/tests/unit/string_lib_test.c b/tests/unit/string_lib_test.c
index 7386d743..be5866c8 100644
--- a/tests/unit/string_lib_test.c
+++ b/tests/unit/string_lib_test.c
@@ -369,6 +369,55 @@ static void test_substring_overshoot(void)
     free(new_string);
 }
 
+static void test_substring_result_is_one_char(void)
+{
+    {
+        char *new_string = StringSubstring("[1]", 3, 1, -1);
+        assert_string_equal(new_string, "1");
+        free(new_string);
+    }
+    {
+        char *new_string = StringSubstring("[1]", 3, 0, 1);
+        assert_string_equal(new_string, "[");
+        free(new_string);
+    }
+    {
+        char *new_string = StringSubstring("[1]", 3, 2, 1);
+        assert_string_equal(new_string, "]");
+        free(new_string);
+    }
+    {
+        char *new_string = StringSubstring("1", 1, 0, 1);
+        assert_string_equal(new_string, "1");
+        free(new_string);
+    }
+    {
+        char *new_string = StringSubstring("1", 1, 0, -1);
+        assert_string_equal(new_string, "1");
+        free(new_string);
+    }
+    {
+        char *new_string = StringSubstring("1", 1, 0, 0);
+        assert_string_equal(new_string, "");
+        free(new_string);
+    }
+}
+
+static void test_substring_empty_input(void)
+{
+    char *new_string = StringSubstring("", 0, 0, 1);
+    assert_string_equal(new_string, "");
+    free(new_string);
+}
+
+static void test_substring_empty_output(void)
+{
+    char *new_string = StringSubstring("\"\"", 2, 1, -1);
+    assert_string_equal(new_string, "");
+    free(new_string);
+}
+
+
 static void test_substring_positive(void)
 {
     char *new_string = StringSubstring("abcdef", 6, 2, 3);
@@ -396,8 +445,9 @@ static void test_substring_negative(void)
 static void test_substring_evil(void)
 {
     char *new_string = StringSubstring("abcdef", 6, 4, -4);
+    assert_string_equal(new_string, "");
+    free(new_string);
 
-    assert_int_equal(new_string, NULL);
 }
 
 static void test_string_to_long(void)
@@ -1568,6 +1618,9 @@ int main()
         unit_test(test_concatenate),
 
         unit_test(test_substring_overshoot),
+        unit_test(test_substring_result_is_one_char),
+        unit_test(test_substring_empty_input),
+        unit_test(test_substring_empty_output),
         unit_test(test_substring_positive),
         unit_test(test_substring_negative_length),
         unit_test(test_substring_negative),