Miscalculated Buffer Sizes

Buffer allocations and substring math rely on incorrect length assumptions (e.g., missing upper-bound checks, flawed remaining-size formulas, or using the wrong strlen basis), so subsequent strcpy/strcat writes can overrun or mis-terminate memory.