I have used the DJB's stralloc library a lot. Not a single vulnerability, binary string safe. Good enough for 99% of applications.

https://cr.yp.to/lib/stralloc.html