A few months ago I told everyone not to use strnstr. This bug was fixed in Leopard, but persisted in Tiger. Today, Apple finally fixed it in Tiger. Now you can safely use strnstr. I assume that this bug probably still exists on Panther and earlier, but as long as you're targeting Tiger and up (as every sane person ought to), you are now safe.

The strnstr function is broken on Mac OS X 10.4 (and presumably earlier) and should be avoided.