...
A number of existing libraries are available for managing string data; the library selected depends on the approach adopted for managing null-terminated byte strings. The functions defined by the C Standard, subclause 7.24, are primarily intended for managing statically allocated strings. However, these functions are problematic because many of them are insufficiently bounded. Consequently, this standard recommends using the C11 Annex K functions with statically allocated arrays. (See STR07-C. Use the bounds-checking interfaces for string manipulation.) These functions provide bounds-checking interfaces to protect against buffer overflows and other runtime constraint violations.
ISO/IEC TR 24731 Part II offers another one approach to resolve this, supplying functions that allocate enough memory for their results [ISO/IEC TR 24731-2]. It provides an API that dynamically allocates the results of string functions as needed. Almost all of the APIs in this technical report are also in a current international standard. For example, TR 24731 Part II includes POSIX functions, such as strdup() [ISO/IEC 9945:2003], as well as functions from the Linux Standard Base Core Specification such as asprintf() [ISO/IEC 23360-1:2006].
...