1.\" Copyright (c) 1990, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" This code is derived from software contributed to Berkeley by 5.\" Chris Torek and the American National Standards Committee X3, 6.\" on Information Processing Systems. 7.\" 8.\" Redistribution and use in source and binary forms, with or without 9.\" modification, are permitted provided that the following conditions 10.\" are met: 11.\" 1. Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" 2. Redistributions in binary form must reproduce the above copyright 14.\" notice, this list of conditions and the following disclaimer in the 15.\" documentation and/or other materials provided with the distribution. 16.\" 3. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)strcat.3 8.1 (Berkeley) 6/4/93 33.\" 34.Dd April 3, 2022 35.Dt STRCAT 3 36.Os 37.Sh NAME 38.Nm strcat , 39.Nm strncat 40.Nd concatenate strings 41.Sh LIBRARY 42.Lb libc 43.Sh SYNOPSIS 44.In string.h 45.Ft char * 46.Fn strcat "char * restrict s" "const char * restrict append" 47.Ft char * 48.Fn strncat "char * restrict s" "const char * restrict append" "size_t count" 49.Sh DESCRIPTION 50The 51.Fn strcat 52and 53.Fn strncat 54functions 55append a copy of the null-terminated string 56.Fa append 57to the end of the null-terminated string 58.Fa s , 59then add a terminating 60.Ql \e0 . 61The string 62.Fa s 63must have sufficient space to hold the result. 64If 65.Fa s 66and 67.Fa append 68overlap, the results are undefined. 69.Pp 70The 71.Fn strncat 72function 73appends not more than 74.Fa count 75characters from 76.Fa append , 77and then adds a terminating 78.Ql \e0 . 79If 80.Fa s 81and 82.Fa append 83overlap, the results are undefined. 84.Sh RETURN VALUES 85The 86.Fn strcat 87and 88.Fn strncat 89functions 90return the pointer 91.Fa s . 92.Sh SEE ALSO 93.Xr bcopy 3 , 94.Xr memccpy 3 , 95.Xr memcpy 3 , 96.Xr memmove 3 , 97.Xr strcpy 3 , 98.Xr strlcat 3 , 99.Xr strlcpy 3 , 100.Xr wcscat 3 101.Sh STANDARDS 102The 103.Fn strcat 104and 105.Fn strncat 106functions 107conform to 108.St -isoC . 109.Sh HISTORY 110The 111.Fn strcat 112function first appeared in the Programmer's Workbench (PWB/UNIX) 113and was ported to 114.At v7 ; 115.Fn strncat 116first appeared in 117.At v7 . 118.Sh SECURITY CONSIDERATIONS 119The 120.Fn strcat 121function is easily misused in a manner 122which enables malicious users to arbitrarily change 123a running program's functionality through a buffer overflow attack. 124.Pp 125Avoid using 126.Fn strcat . 127Instead, use 128.Fn strncat 129or 130.Fn strlcat 131and ensure that no more characters are copied to the destination buffer 132than it can hold. 133.Pp 134Note that 135.Fn strncat 136can also be problematic. 137It may be a security concern for a string to be truncated at all. 138Since the truncated string will not be as long as the original, 139it may refer to a completely different resource 140and usage of the truncated resource 141could result in very incorrect behavior. 142Example: 143.Bd -literal 144void 145foo(const char *arbitrary_string) 146{ 147 char onstack[8]; 148 149#if defined(BAD) 150 /* 151 * This first strcat is bad behavior. Do not use strcat! 152 */ 153 (void)strcat(onstack, arbitrary_string); /* BAD! */ 154#elif defined(BETTER) 155 /* 156 * The following two lines demonstrate better use of 157 * strncat(). 158 */ 159 (void)strncat(onstack, arbitrary_string, 160 sizeof(onstack) - strlen(onstack) - 1); 161#elif defined(BEST) 162 /* 163 * These lines are even more robust due to testing for 164 * truncation. 165 */ 166 if (strlen(arbitrary_string) + 1 > 167 sizeof(onstack) - strlen(onstack)) 168 err(1, "onstack would be truncated"); 169 (void)strncat(onstack, arbitrary_string, 170 sizeof(onstack) - strlen(onstack) - 1); 171#endif 172} 173.Ed 174