From 5bfe15ad2feeee42e241fffa07c5a9b1fdaf5751 Mon Sep 17 00:00:00 2001
From: ru <ru@FreeBSD.org>
Date: Thu, 19 Jul 2001 18:58:31 +0000
Subject: vsnprintf() can return a value larger than the buffer size.

Submitted by:	assar
Obtained from:	OpenBSD
---
 crypto/telnet/telnetd/state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'crypto/telnet')

diff --git a/crypto/telnet/telnetd/state.c b/crypto/telnet/telnetd/state.c
index ec012cf..1346c95 100644
--- a/crypto/telnet/telnetd/state.c
+++ b/crypto/telnet/telnetd/state.c
@@ -1631,7 +1631,7 @@ output_data(const char *format, ...)
 		remaining = BUFSIZ - (nfrontp - netobuf);
 	}
 	ret = vsnprintf(nfrontp, remaining, format, args);
-	nfrontp += ret;
+	nfrontp += ((ret < remaining - 1) ? ret : remaining - 1);
 	va_end(args);
 	return ret;
 }
-- 
cgit v1.1