possible overflow here; why not just `char *tmp = strdup(path)`?