tar/[REDACTED] env construction: strcpy on attacker-controlled value

[REDACTED]: unsafe strcpy when building A=B env strings