strncat only returns its first argument and not the end of the written string.
Thus "buf-pos" is always 0 and consquently no range check is performed.
Signed-off-by: Niklas Eiling <niklas.eiling@rwth-aachen.de>