Fix buffer overflow in cats().