diff --git a/storage/connect/tabxml.cpp b/storage/connect/tabxml.cpp
index 49fa9a1..65645c2 100644
--- a/storage/connect/tabxml.cpp
+++ b/storage/connect/tabxml.cpp
@@ -225,30 +225,30 @@ PQRYRES XMLColumns(PGLOBAL g, char *db, char *tab, PTOS topt, bool info)
      more:
       if (vp->atp) {
         strncpy(colname, vp->atp->GetName(g), sizeof(colname));
-        strncat(xcol->Name, colname, 64);
+        strncat(xcol->Name, colname, 64 - strlen(xcol->Name) - 1);
 
         switch (vp->atp->GetText(g, buf, sizeof(buf))) {
           case RC_INFO:
             PushWarning(g, txmp);
           case RC_OK:
-            strncat(fmt, "@", sizeof(fmt));
+            strncat(fmt, "@", sizeof(fmt) - strlen(fmt) - 1);
             break;
           default:
             goto err;
           } // enswitch rc
 
         if (j)
-          strncat(fmt, colname, sizeof(fmt));
+          strncat(fmt, colname, sizeof(fmt) - strlen(fmt) -1);
 
       } else {
         if (tdp->Usedom && node->GetType() != 1)
           continue;
 
         strncpy(colname, node->GetName(g), sizeof(colname));
-        strncat(xcol->Name, colname, 64);
+        strncat(xcol->Name, colname, 64 - strlen(xcol->Name) - 1);
 
         if (j)
-          strncat(fmt, colname, sizeof(fmt));
+          strncat(fmt, colname, sizeof(fmt) - strlen(fmt) - 1);
 
         if (j < lvl && ok) {
           vp = lvlp[j+1];
@@ -266,8 +266,9 @@ PQRYRES XMLColumns(PGLOBAL g, char *db, char *tab, PTOS topt, bool info)
             if (!vp->atp)
               node = vp->nl->GetItem(g, vp->k++, node);
 
-            strncat(strncat(fmt, colname, 125), "/", 125);
-            strncat(xcol->Name, "_", 64);
+            strncat(strncat(fmt, colname, sizeof(fmt) - strlen(fmt) - 1),
+                    "/", sizeof(fmt) - strlen(fmt) - strlen(colname) - 1);
+            strncat(xcol->Name, "_", 64 - strlen(xcol->Name) - 1);
             j++;
             vp->n = (int)strlen(xcol->Name);
             vp->m = (int)strlen(fmt);