Make BUF_strndup() read-safe on arbitrary inputs