Index: contrib/ntp/ntpd/ntp_control.c
===================================================================
RCS file: /home/ncvs/src/contrib/ntp/ntpd/ntp_control.c,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 ntp_control.c
--- contrib/ntp/ntpd/ntp_control.c	2000/01/28 14:53:03	1.1.1.2
+++ contrib/ntp/ntpd/ntp_control.c	2001/04/06 19:34:50
@@ -1610,7 +1610,7 @@
 	/*
 	 * Delete leading commas and white space
 	 */
-	while (reqpt < reqend && (*reqpt == ',' || isspace((int)*reqpt))) {
+	while (reqpt < reqend && (*reqpt == ',' || isspace((unsigned char)*reqpt))) {
 		reqpt++;
 	}
 
@@ -1634,7 +1634,7 @@
 				tp++;
 			}
 			if ((*tp == '\0') || (*tp == '=')) {
-				while (cp < reqend && isspace((int)*cp))
+				while (cp < reqend && isspace((unsigned char)*cp))
 					cp++;
 				if (cp == reqend || *cp == ',') {
 					buf[0] = '\0';
@@ -1647,14 +1647,17 @@
 				if (*cp == '=') {
 					cp++;
 					tp = buf;
-					while (cp < reqend && isspace((int)*cp))
+					while (cp < reqend && isspace((unsigned char)*cp))
 						cp++;
-					while (cp < reqend && *cp != ',')
+					while (cp < reqend && *cp != ',') {
 						*tp++ = *cp++;
+						if (tp >= buf + sizeof(buf))
+							return (0);
+					}
 					if (cp < reqend)
 						cp++;
 					*tp = '\0';
-					while (isspace((int)(*(tp-1))))
+					while (tp != buf && isspace((unsigned char)(*(tp-1))))
 						*(--tp) = '\0';
 					reqpt = cp;
 					*data = buf;