When finding the end of dst, never traverse more than siz bytes. This

keeps us from misbehaving if the user gives us a src string that is not
NUL-terminated.  This is one of those "should not happen" cases but it
is good to play it safe.  Pointed out by Casper Dik <casper@holland.sun.com>

src/lib/libc/string/strlcat.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: strlcat.c,v 1.1 1998/07/01 01:29:45 millert Exp $	*/
+/*	$OpenBSD: strlcat.c,v 1.2 1999/06/17 16:28:58 millert Exp $	*/
 
 /*
  * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -28,7 +28,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: strlcat.c,v 1.1 1998/07/01 01:29:45 millert Exp $";
+static char *rcsid = "$OpenBSD: strlcat.c,v 1.2 1999/06/17 16:28:58 millert Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/types.h>
@@ -50,11 +50,11 @@ size_t strlcat(dst, src, siz)
 	register size_t n = siz;
 	size_t dlen;
 
-	/* Find the end of dst and adjust bytes left */
-	while (*d != '\0' && n != 0)
+	/* Find the end of dst and adjust bytes left but don't go past end */
+	while (*d != '\0' && n-- != 0)
 		d++;
 	dlen = d - dst;
-	n -= dlen;
+	n = siz - dlen;
 
 	if (n == 0)
 		return(dlen + strlen(s));