fix crash caused by strcpy() without size check