You don't need two mallocs, you need one:  just malloc to that probably-constant size and be done with it.  If you *really really* want to avoid an allocation out of the heap, which seems a little unnecessary given to me, then stuff your stack-allocated buffer into a `git_buf` and let it crash in `realloc` if your assumptions about length are ever violated.

I would prefer that to stomping all over a buffer if you ever end up with a system that reports its year as y10k.  But it still sucks, and saving a malloc shouldn't be an excuse for unsafe behavior that is probably, almost always correct, except when there's some bug upstream that we didn't expect.

I realize that I'm taking a hardline stance against this.  Let me rewind a little bit and provide some additional context here.  Libgit2 is both contributed to and used by many people that have myriad requirements.  Mine, for example, require a slavish adherence to development policies, in particular the Security Development Lifecycle which precludes the usage of various functions that are unsafe and a frequent source of errors, like `sprintf`.

Including [`banned.h`](http://www.microsoft.com/en-us/download/details.aspx?id=24817) turns a usage of `sprintf` into a `#error`.

http://msdn.microsoft.com/en-us/library/bb288454.aspx