1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" This code is derived from software contributed to Berkeley by 5.\" Chris Torek and the American National Standards Committee X3, 6.\" on Information Processing Systems. 7.\" 8.\" Redistribution and use in source and binary forms, with or without 9.\" modification, are permitted provided that the following conditions 10.\" are met: 11.\" 1. Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" 2. Redistributions in binary form must reproduce the above copyright 14.\" notice, this list of conditions and the following disclaimer in the 15.\" documentation and/or other materials provided with the distribution. 16.\" 3. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)strcat.3 8.1 (Berkeley) 6/4/93 33.\" $FreeBSD: src/lib/libc/string/strcat.3,v 1.15 2007/01/09 00:28:12 imp Exp $ 34.\" $DragonFly: src/lib/libc/string/strcat.3,v 1.3 2007/10/19 20:46:53 swildner Exp $ 35.\" 36.Dd June 4, 1993 37.Dt STRCAT 3 38.Os 39.Sh NAME 40.Nm strcat , 41.Nm strncat 42.Nd concatenate strings 43.Sh LIBRARY 44.Lb libc 45.Sh SYNOPSIS 46.In string.h 47.Ft char * 48.Fn strcat "char * restrict s" "const char * restrict append" 49.Ft char * 50.Fn strncat "char * restrict s" "const char * restrict append" "size_t count" 51.Sh DESCRIPTION 52The 53.Fn strcat 54and 55.Fn strncat 56functions 57append a copy of the null-terminated string 58.Fa append 59to the end of the null-terminated string 60.Fa s , 61then add a terminating 62.Ql \e0 . 63The string 64.Fa s 65must have sufficient space to hold the result. 66.Pp 67The 68.Fn strncat 69function 70appends not more than 71.Fa count 72characters from 73.Fa append , 74and then adds a terminating 75.Ql \e0 . 76.Sh RETURN VALUES 77The 78.Fn strcat 79and 80.Fn strncat 81functions 82return the pointer 83.Fa s . 84.Sh SECURITY CONSIDERATIONS 85The 86.Fn strcat 87function is easily misused in a manner 88which enables malicious users to arbitrarily change 89a running program's functionality through a buffer overflow attack. 90(See 91the FSA.) 92.Pp 93Avoid using 94.Fn strcat . 95Instead, use 96.Fn strncat 97or 98.Fn strlcat 99and ensure that no more characters are copied to the destination buffer 100than it can hold. 101.Pp 102Note that 103.Fn strncat 104can also be problematic. 105It may be a security concern for a string to be truncated at all. 106Since the truncated string will not be as long as the original, 107it may refer to a completely different resource 108and usage of the truncated resource 109could result in very incorrect behavior. 110Example: 111.Bd -literal 112void 113foo(const char *arbitrary_string) 114{ 115 char onstack[8]; 116 117#if defined(BAD) 118 /* 119 * This first strcat is bad behavior. Do not use strcat! 120 */ 121 strcat(onstack, arbitrary_string); /* BAD! */ 122#elif defined(BETTER) 123 /* 124 * The following two lines demonstrate better use of 125 * strncat(). 126 */ 127 strncat(onstack, arbitrary_string, 128 sizeof(onstack) - strlen(onstack) - 1); 129#elif defined(BEST) 130 /* 131 * These lines are even more robust due to testing for 132 * truncation. 133 */ 134 if (strlen(arbitrary_string) + 1 > 135 sizeof(onstack) - strlen(onstack)) 136 err(1, "onstack would be truncated"); 137 strncat(onstack, arbitrary_string, 138 sizeof(onstack) - strlen(onstack) - 1); 139#endif 140} 141.Ed 142.Sh SEE ALSO 143.Xr bcopy 3 , 144.Xr memccpy 3 , 145.Xr memcpy 3 , 146.Xr memmove 3 , 147.Xr strcpy 3 , 148.Xr strlcat 3 , 149.Xr strlcpy 3 150.Sh STANDARDS 151The 152.Fn strcat 153and 154.Fn strncat 155functions 156conform to 157.St -isoC . 158