--- ntpd/ntp_control.c.orig	Thu Apr  5 20:28:09 2001
+++ ntpd/ntp_control.c	Thu Apr  5 20:46:42 2001
@@ -1819,15 +1819,18 @@
 					cp++;
 					tp = buf;
 					while (cp < reqend &&
-					    isspace((int)*cp))
+					    isspace((unsigned char)*cp))
 						cp++;
-					while (cp < reqend && *cp !=
-					    ',')
+					while (cp < reqend && *cp != ',') {
 						*tp++ = *cp++;
+						if (tp >= buf + sizeof(buf)) 
+							return 0;
+					};
 					if (cp < reqend)
 						cp++;
 					*tp = '\0';
-					while (isspace((int)(*(tp-1))))
+					while (tp != buf && 
+									isspace((unsigned char)(*(tp-1))))
 						*(--tp) = '\0';
 					reqpt = cp;
 					*data = buf;