However this makes the function non-thread-safe and non-renterant which limits its use, and as well as that you end up storing the password in memory for the permanent life of the program.
Oh no, not 10 bytes!
The correct way to solve this is using a 50K buffer (on the stack, like the original program does), and putting the string 24K in. It is unlikely that any implementation of strcpy() will use that much stack, so the string will remain safe. It will take a lot of abuse until it's overwritten, and if it does, you can just increase the buffer.
>>3
You start like that and you end with a 5MB .bss and compile errors on certain architectures. Also, maybe you missed the other half of you're quote.