Yes, that's one of the three CVE's I posted ;). You got me thinking about ways one could get strdup wrong: - input is not a string -> possible UB - input is

Yes, that's one of the three CVE's I posted ;). You got me thinking about ways one could get strdup wrong: - input is not a string -> possible UB - input is a string, but the character encoding wasn't what you thought -> possible UB - input is a string, but it was the pointer-plus-length kind -> possible UB - input is modified by another thread -> possible UB - strdup called from within a signal handler -> possible UB - failure to handle error return values -> possible UB - failure to free the memory when it's no longer needed -> memory leak - freed the memory more than once -> possible UB - used the memory after freeing it -> possible UB I've personally seen several of these in real-world code.