That's a non-problem

Yes indeed. Of course what people then do is use strdup() and forget to check for NULL returns: you'd think 'oh that only leads to a coredump, DoS only', but thanks to structures and arrays it's quite easy to convert a pointer to NULL into a pointer to *anywhere*, so NULL dereferences are often security holes.

C is a nice low-level language but should never be allowed near user data, IMHO. (Now, back to work for me, writing financial stuff in C which spends all its time getting near user data.)