vsnprintf() can return a value larger than the buffer size.

Submitted by:	assar
Obtained from:	OpenBSD

1 files changed, 1 insertions, 1 deletions

diff --git a/contrib/telnet/telnetd/state.c b/contrib/telnet/telnetd/state.c
index ec012cf..1346c95 100644
--- a/contrib/telnet/telnetd/state.c
+++ b/contrib/telnet/telnetd/state.c
@@ -1631,7 +1631,7 @@ output_data(const char *format, ...)
 		remaining = BUFSIZ - (nfrontp - netobuf);
 	}
 	ret = vsnprintf(nfrontp, remaining, format, args);
-	nfrontp += ret;
+	nfrontp += ((ret < remaining - 1) ? ret : remaining - 1);
 	va_end(args);
 	return ret;
 }