- GHOST_SystemPathsCocoa::getUserSpecialDir used `strncpy` without ensuring the string was null terminated. - GHOST_SystemPathsCocoa::getBinaryDir used `strcpy` without checking the destination buffer size.