vsnprintf() can return a value larger than the buffer size.

Submitted by:	assar
Obtained from:	OpenBSD


git-svn-id: http://svn0.us-east.freebsd.org/base/head/contrib/telnet@79992 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f

telnetd/state.c

@@ -1631,7 +1631,7 @@ output_data(const char *format, ...)
 		remaining = BUFSIZ - (nfrontp - netobuf);
 	}
 	ret = vsnprintf(nfrontp, remaining, format, args);
-	nfrontp += ret;
+	nfrontp += ((ret < remaining - 1) ? ret : remaining - 1);
 	va_end(args);
 	return ret;
 }