tar/[REDACTED] env construction: strcpy on attacker-controlled value

In tar's bundled gnulib wordsplit implementation, [REDACTED] builds environment strings using strcpy into a heap buffer sized as namelen + strlen(value) + 2, but the buffer pointer arithmetic uses namelen++ before the copy, creating an off-by-one hazard if namelen/value length relationships ever desynchronize (e.g., unusual name lengths or internal assumptions). This is flagged by flawfinder as [REDACTED].