Salvatore Sanfilippo, from Redis fame, has a nice one https://github.com/antirez/sds.

Thanks for linking this, it's always good to see how very strong engineers solve problems. Never in a million years would this approach have occurred to me. For the interested, the README in the linked repo is done well and clearly explains the approach itself as well as pros and cons. This also reminded me that I've been meaning to watch antirez' "Writing System Software"[0] videos on YouTube for quite a while now, so thanks for that too.

[0]: https://www.youtube.com/playlist?list=PLrEMgOSrS_3fghr8ez63x...

I'd rather make it explicit that returned/passed value is something other than a regular zero terminated string. Otherwise you can easilly make a mess, if you pass zero terminated string to a function that expects some special bytes in the memory before the pointer.

I do this, but I like to just return the actual struct and also avoid typedefing pointer semantics. Can double as a dynamic array too. It's true. We all have string libraries...

I haven't looked much so I can't comment on the quality of the library but that hairdo is glorious. Props to Salvatore!

There are far too many. APR is a solid choice -- very portable, well-tested, and fast. It uses memory pools a lot, which work well for many styles but not everything.

See https://apr.apache.org/docs/apr/1.7/modules.html

This is a good place to start:

https://dwheeler.com/secure-programs/3.71/Secure-Programs-HO...

What's wrong with glib, other than not being lightweight? I love glib.

libbsd has strlcat and strlcpy.

or just use snprintf everywhere.

Rust. Half-joking.