You could even use <code> memcpy(node, sp, start); node[start] = '\0'; </code> and avoid str[nl]cpy()'s overhead of checking for '\0' bytes in what it's copying, since you know there's no '\0' in sp[0-to-start].  You should also, at least in principle, be checking start < CF_MAXVARSIZE and handling that suitably (but I guess your original string is at most CF_MAXVARSIZE-1 in length, anyway, thanks to being in a variable buffer wherever it came from).