What's the risk of user supplied strings? Surely you know their size. What else is there to worry about?