C strncat_s function

last modified April 8, 2025

String operations are fundamental in C programming, and strncat_s is a key function for safe string concatenation. This tutorial covers strncat_s in depth, including its syntax, usage, and advantages over unsafe alternatives. We’ll explore practical examples and discuss why safe functions matter in modern C programming. Understanding strncat_s helps prevent buffer overflows while maintaining program safety.

What Is strncat_s?

The strncat_s function safely concatenates a portion of one string to another. It’s declared in string.h and takes four parameters: the destination buffer, its size, source string, and maximum characters to append. Unlike strcat, it performs bounds checking to prevent buffer overflows. This function is part of C11’s Annex K bounds-checking interfaces.

Why Use strncat_s Instead of strcat?

strcat is unsafe because it doesn’t check destination buffer size, leading to potential buffer overflows. strncat_s adds crucial safety checks by requiring the destination size parameter. It also ensures proper null termination of the result. These features make strncat_s essential for secure programming. Always prefer it over strcat in new code.

Basic strncat_s Usage

This example demonstrates basic string concatenation using strncat_s.

basic_concat.c

#define STDC_WANT_LIB_EXT1 1 #include <stdio.h> #include <string.h>

int main() { char dest[20] = “Hello”; const char *src = “, World!”;

// Safe concatenation with bounds checking
errno_t result = strncat_s(dest, sizeof(dest), src, 5);

if (result == 0) {
    printf("Concatenated string: %s\n", dest);
} else {
    printf("Error occurred during concatenation\n");
}

return 0;

}

Here, strncat_s appends up to 5 characters from src to dest. The function checks that dest has enough space remaining. It returns zero on success and non-zero on failure. This example shows the basic pattern of checking the return value for errors.

Concatenating with Full Source Length

This example shows concatenation using the entire source string length.

full_concat.c

#define STDC_WANT_LIB_EXT1 1 #include <stdio.h> #include <string.h>

int main() { char dest[30] = “Programming in “; const char *src = “C is powerful”;

// Concatenate entire source string safely
errno_t result = strncat_s(dest, sizeof(dest), src, strlen(src));

if (result == 0) {
    printf("Complete string: %s\n", dest);
} else {
    printf("Concatenation failed: buffer too small\n");
}

return 0;

}

This code concatenates the entire source string by specifying its length with strlen(src). The destination buffer is large enough to hold the result. The function still performs bounds checking to ensure safety. strncat_s automatically adds a null terminator if space permits.

Handling Buffer Overflow Scenarios

This example demonstrates how strncat_s handles buffer overflow.

overflow_concat.c

#define STDC_WANT_LIB_EXT1 1 #include <stdio.h> #include <string.h>

int main() { char dest[10] = “Test”; const char *src = “This is too long”;

// Attempt concatenation that will overflow
errno_t result = strncat_s(dest, sizeof(dest), src, strlen(src));

if (result != 0) {
    printf("Error %d: Buffer overflow prevented\n", result);
} else {
    printf("Unexpected success - buffer should be too small\n");
}

return 0;

}

Here, strncat_s detects that the destination buffer is too small and returns an error code. This prevents buffer overflow vulnerabilities that could crash the program or be exploited. The function fails safely rather than continuing with potentially dangerous operation. Always check the return value.

Partial String Concatenation

This example shows how to concatenate only part of a source string.

partial_concat.c

#define STDC_WANT_LIB_EXT1 1 #include <stdio.h> #include <string.h>

int main() { char dest[20] = “Selected: “; const char *src = “ABCDEFGHIJKLMNOPQRSTUVWXYZ”;

// Concatenate only first 5 characters
errno_t result = strncat_s(dest, sizeof(dest), src, 5);

if (result == 0) {
    printf("Result: %s\n", dest);
} else {
    printf("Concatenation failed\n");
}

return 0;

}

The code appends only the first 5 characters from the source string. The count parameter limits how many characters are copied, regardless of the source length. This is useful when you need to extract a substring during concatenation. The destination buffer must still have enough space for the selected characters plus null terminator.

Concatenating Multiple Strings

This example demonstrates safe concatenation of multiple strings.

multi_concat.c

#define STDC_WANT_LIB_EXT1 1 #include <stdio.h> #include <string.h>

int main() { char dest[50] = “Components: “; const char *parts[] = {“CPU”, “RAM”, “SSD”, “GPU”};

// Safely concatenate multiple strings
for (int i = 0; i < 4; i++) {
    errno_t result = strncat_s(dest, sizeof(dest), parts[i], strlen(parts[i]));
    if (result != 0) {
        printf("Stopped: buffer full at component %d\n", i);
        break;
    }
    if (i < 3) {
        strncat_s(dest, sizeof(dest), ", ", 2);
    }
}

printf("Final string: %s\n", dest);
return 0;

}

This code safely builds a string from multiple components with separators. Each concatenation checks for available space. The loop breaks if the buffer fills prematurely. This pattern is common when constructing strings from multiple sources. Always maintain proper buffer size accounting in such cases.

Best Practices for Using strncat_s

• Always check return values: Handle errors appropriately when they occur.

• Size destination buffers properly: Include space for null terminators.

• Prefer sizeof with arrays: Use sizeof(dest) for array destinations.

• Initialize destination strings: Ensure destination is properly null-terminated before use.

• Consider platform availability: Not all implementations support Annex K functions.

Source

C strncat_s Documentation

This tutorial has explored the strncat_s function, from basic usage to advanced scenarios. While more verbose than strcat, its safety features make it essential for robust C programming. Always prefer bounds-checked string operations in modern C code.

Author

My name is Jan Bodnar, and I’m a dedicated programmer with a deep passion for coding. Since 2007, I’ve been sharing my expertise through over 1,400 articles and 8 e-books. With more than a decade of teaching experience, I strive to make programming accessible and engaging.

List C Standard Library.