implement basic safe buffer API in C