Don't assume that passwords (and other conv replies) are zero-terminated.
If they are, though, strndup() down below will take care of that.