wget shows us why C string handling sucks:

  /* Allocate the memory for the request.  */
  request = (char *)alloca (strlen (command)
                            + strlen (full_path)
                            + strlen (useragent)
                            + strlen (u->host)
                            + (port_maybe ? strlen (port_maybe) : 0)
                            + strlen (HTTP_ACCEPT)
                            + (request_keep_alive
                               ? strlen (request_keep_alive) : 0)
                            + (referer ? strlen (referer) : 0)
                            + (cookies ? strlen (cookies) : 0)
                            + (wwwauth ? strlen (wwwauth) : 0)
                            + (proxyauth ? strlen (proxyauth) : 0)
                            + (range ? strlen (range) : 0)
                            + strlen (pragma_h)
                            + (post_content_type
                               ? strlen (post_content_type) : 0)
                            + (post_content_length
                               ? strlen (post_content_length) : 0)
                            + (opt.user_header ? strlen (opt.user_header) : 0)
                            + 64);