pathencode: don't use alloca() for safety/portability