Only if using a hardened runtime with bounds checking enabled, without any calls to c_str().