string.c: do not interpret '\\' before '\0' (CVE-2019-15846)