It's not really a "bug". C99 adopted snprintf(), which had become a de facto standard in POSIX code prior to C99, and with it adopted a feature (formatting "into" NULL to get the length of the required buffer) that was not universally implemented.
It's a portability issue.
If you really truly cared about maximum portability, you'd just take a libc snprintf() that did the NULL-size thing and bundle it with your project, just like the AIX version of Sendmail bundled snprintf() because the platform didn't have it.
Or, even better: JETTISON THE PRINTF FAMILY and replace it with something that lets you register your own format codes. This is all ANSI C string manipulation and this code compiles small and in milliseconds.
But in this case the whole discussion is silly because the dynamic string buffer here is not only overengineered (both Unix paths and command line arguments have size restrictions and so dynamic sizing is silly) but also non-idiomatic.