glibc bug?

void add_cname(char *name, char *target){  struct cname_record *r = safe_malloc(sizeof(struct cname_record));  char *tmpsrc, *tmpdest;  int len;  tmpsrc = name;  while (1) {    if (*(tmpsrc + strlen(tmpsrc)-1) != '.') {        len = strlen(tmpsrc) + strlen(daemon->domain_suffix);        tmpdest = safe_malloc(len+2);        memset(tmpdest, 0, len+2);        memcpy(tmpdest, tmpsrc, strlen(tmpsrc));        memset(tmpdest+strlen(tmpsrc), '.', 1);//      *(tmpdest+strlen(*tmpsrc)) = '.';        memcpy(tmpdest+strlen(tmpsrc) + 1, daemon->domain_suffix, strlen(daemon->domain_suffix));//      strcpy(tmpdest+strlen(*tmpsrc) + 1, daemon->domain_suffix);    } else {        len = strlen(tmpsrc);        tmpdest = safe_malloc(len+1);        memset(tmpdest, 0, len+1);        memcpy(tmpdest, tmpsrc, strlen(tmpsrc));//      strcpy(tmpdest, *tmpsrc);    }    my_syslog(LOG_INFO, _("in working form '%s', '%s'"), tmpdest, tmpsrc);    if (tmpsrc == name) {        tmpsrc = target;        r->name = tmpdest;        my_syslog(LOG_INFO, _("in set form name: '%s'"), r->name);    } else {        r->target = tmpdest;        my_syslog(LOG_INFO, _("in set form target: '%s'"), r->target);        break;    }  }  my_syslog(LOG_INFO, _("added cname '%s' => '%s'"), r->name, r->target);  r->next = daemon->cnames;  daemon->cnames = r;  // this removes a ! from the end of even sized strings...  // I have NO idea why it ends up there.  :/  // If I do this, it works, but when I try to free the memory, it glibc crashes  // with '*** glibc detected *** [EXECUTABLE_FILENAME]: free(): invalid next size (fast): 0x0806df88 ***'/*  if (r->name[strlen(r->name)-1] == 33)    r->name[strlen(r->name)-1] = (char)0;*/}