use strndupa and strnlen for safe length checks.