1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" This code is derived from software contributed to Berkeley by 5.\" Chris Torek and the American National Standards Committee X3, 6.\" on Information Processing Systems. 7.\" 8.\" Redistribution and use in source and binary forms, with or without 9.\" modification, are permitted provided that the following conditions 10.\" are met: 11.\" 1. Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" 2. Redistributions in binary form must reproduce the above copyright 14.\" notice, this list of conditions and the following disclaimer in the 15.\" documentation and/or other materials provided with the distribution. 16.\" 3. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)strcat.3 8.1 (Berkeley) 6/4/93 33.\" $FreeBSD$ 34.\" 35.Dd April 3, 2022 36.Dt STRCAT 3 37.Os 38.Sh NAME 39.Nm strcat , 40.Nm strncat 41.Nd concatenate strings 42.Sh LIBRARY 43.Lb libc 44.Sh SYNOPSIS 45.In string.h 46.Ft char * 47.Fn strcat "char * restrict s" "const char * restrict append" 48.Ft char * 49.Fn strncat "char * restrict s" "const char * restrict append" "size_t count" 50.Sh DESCRIPTION 51The 52.Fn strcat 53and 54.Fn strncat 55functions 56append a copy of the null-terminated string 57.Fa append 58to the end of the null-terminated string 59.Fa s , 60then add a terminating 61.Ql \e0 . 62The string 63.Fa s 64must have sufficient space to hold the result. 65If 66.Fa s 67and 68.Fa append 69overlap, the results are undefined. 70.Pp 71The 72.Fn strncat 73function 74appends not more than 75.Fa count 76characters from 77.Fa append , 78and then adds a terminating 79.Ql \e0 . 80If 81.Fa s 82and 83.Fa append 84overlap, the results are undefined. 85.Sh RETURN VALUES 86The 87.Fn strcat 88and 89.Fn strncat 90functions 91return the pointer 92.Fa s . 93.Sh SEE ALSO 94.Xr bcopy 3 , 95.Xr memccpy 3 , 96.Xr memcpy 3 , 97.Xr memmove 3 , 98.Xr strcpy 3 , 99.Xr strlcat 3 , 100.Xr strlcpy 3 , 101.Xr wcscat 3 102.Sh STANDARDS 103The 104.Fn strcat 105and 106.Fn strncat 107functions 108conform to 109.St -isoC . 110.Sh HISTORY 111The 112.Fn strcat 113function first appeared in the Programmer's Workbench (PWB/UNIX) 114and was ported to 115.At v7 ; 116.Fn strncat 117first appeared in 118.At v7 . 119.Sh SECURITY CONSIDERATIONS 120The 121.Fn strcat 122function is easily misused in a manner 123which enables malicious users to arbitrarily change 124a running program's functionality through a buffer overflow attack. 125.Pp 126Avoid using 127.Fn strcat . 128Instead, use 129.Fn strncat 130or 131.Fn strlcat 132and ensure that no more characters are copied to the destination buffer 133than it can hold. 134.Pp 135Note that 136.Fn strncat 137can also be problematic. 138It may be a security concern for a string to be truncated at all. 139Since the truncated string will not be as long as the original, 140it may refer to a completely different resource 141and usage of the truncated resource 142could result in very incorrect behavior. 143Example: 144.Bd -literal 145void 146foo(const char *arbitrary_string) 147{ 148 char onstack[8]; 149 150#if defined(BAD) 151 /* 152 * This first strcat is bad behavior. Do not use strcat! 153 */ 154 (void)strcat(onstack, arbitrary_string); /* BAD! */ 155#elif defined(BETTER) 156 /* 157 * The following two lines demonstrate better use of 158 * strncat(). 159 */ 160 (void)strncat(onstack, arbitrary_string, 161 sizeof(onstack) - strlen(onstack) - 1); 162#elif defined(BEST) 163 /* 164 * These lines are even more robust due to testing for 165 * truncation. 166 */ 167 if (strlen(arbitrary_string) + 1 > 168 sizeof(onstack) - strlen(onstack)) 169 err(1, "onstack would be truncated"); 170 (void)strncat(onstack, arbitrary_string, 171 sizeof(onstack) - strlen(onstack) - 1); 172#endif 173} 174.Ed 175