Then we have strchr, strrchr, strchrnul. Aside from suggestion of replacing every strchr with strchrnul there are missed optimizations of strchr(x,0) and strchrnul(x,0). A strrchr(x,0) expands just to strchr(x,0) which is not enough as it should do full expansion to x+strlen(x). Then you miss case when x is constant as in wordexp.