It’s trivial to use slices/builders, aka char arrays with length, in these cases, and have bounds checking. You are reading and writing byte arrays anyways.

I read the comment you reply on as a reason not to use C.

If you want to generate HTML properly, you treat as the tree it is, instead of doing string concatenation. If you do that, then you also don't need to do much with strings, so that problem is already solved.