title: Why are strlcpy and strlcat considered insecure?
body: <p>I understand that <code>strlcpy</code> and <code>strlcat</code> were designed as secure replacements for <code>strncpy</code> and <code>strncat</code>. However, some people are still of the opinion that they are <a href="https://en.wikipedia.org/wiki/C_string_handling#Replacements" rel="noreferrer">insecure, and simply cause a different type of problem</a>.</p>
  
  <p>Can someone give an example of how using <code>strlcpy</code> or <code>strlcat</code> (i.e. a function that <em>always</em> null terminates its strings) can lead to security problems?</p>
  
  <p>Ulrich Drepper and James Antill state this is true, but never provide examples or clarify this point.</p>