A few months ago I told everyone not to use strnstr. This bug was fixed in Leopard, but persisted in Tiger. Today, Apple finally fixed it in Tiger. Now you can safely use strnstr. I assume that this bug probably still exists on Panther and earlier, but as long as you're targeting Tiger and up (as every sane person ought to), you are now safe.