strlcat() needs to be informed about the actual size of the buffer. Two
calls simply used the size expected, thus potentially allowing
stack-based buffer overflows.
There is no direct security impact in this case, since the code affected
is on the client side, and the input comes from configuration
information.