The strcpy writes the terminating null byte as well.

[adelton]

Addressing

tmpnam.c:48:5: warning: ‘strcpy’ writing one too many bytes into a region of a size that depends on ‘strlen’ [-Wstringop-overflow=]
   48 |     strcpy(ptr2, ptr);
      |     ^~~~~~~~~~~~~~~~~
tmpnam.c:45:12: note: at offset 0 to an object allocated by ‘malloc’ here
   45 |     ptr2 = malloc(strlen(ptr));
      |            ^~~~~~~~~~~~~~~~~~~
  CCLD     libfakechroot.la