This is a function that has only a single user but has been pulled out and put in another file to make life more complicated instead of doing it locally where the conditions of the parameters are visible [end rant].
The overflow is when name is `\0` and the use probably thinks it is never `\0` by using the user real name if it is, so the past the end won't happen, but I suppose its possible (though very very unlikely) for a user real name to be empty, so yeah why not be safe.