fn cstring_safe(s: &str) -> CString