From 819182e3f6cec95f712219f22ea48faacc14c0bb Mon Sep 17 00:00:00 2001
From: ru <ru@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Thu, 19 Jul 2001 18:58:31 +0000
Subject: [PATCH] vsnprintf() can return a value larger than the buffer size.

Submitted by:	assar
Obtained from:	OpenBSD


git-svn-id: http://svn0.us-east.freebsd.org/base/head/contrib/telnet@79992 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 telnetd/state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/telnetd/state.c b/telnetd/state.c
index ec012cf..1346c95 100644
--- a/telnetd/state.c
+++ b/telnetd/state.c
@@ -1631,7 +1631,7 @@ output_data(const char *format, ...)
 		remaining = BUFSIZ - (nfrontp - netobuf);
 	}
 	ret = vsnprintf(nfrontp, remaining, format, args);
-	nfrontp += ret;
+	nfrontp += ((ret < remaining - 1) ? ret : remaining - 1);
 	va_end(args);
 	return ret;
 }