security fix: replaced some strcat with strncat