For people who say "C strings are null-terminated and you don't pass their length, get used to it", let me point out https://www.securecoding.cert.org/confluence/display/seccode..., which is part of the "CERT C Secure Coding Standard", and the new bounds-checking features in C11 (which I haven't actually seen yet).