Formal Verification of a C-Library for Strings