From ac032896fc1e40822a01ccaaefcd7eeaf136ba06 Mon Sep 17 00:00:00 2001
From: Jiri Skala <jskala@redhat.com>
Date: Sep 09 2011 13:45:37 +0000
Subject: fixes #737016 - ftp: off-by-one in account command parsing


---

diff --git a/ftp.spec b/ftp.spec
index 8600bf4..bdd98dd 100644
--- a/ftp.spec
+++ b/ftp.spec
@@ -1,7 +1,7 @@
 Summary: The standard UNIX FTP (File Transfer Protocol) client
 Name: ftp
 Version: 0.17
-Release: 53%{?dist}
+Release: 54%{?dist}
 License: BSD with advertising
 Group: Applications/Internet
 Source0: ftp://ftp.uk.linux.org/pub/linux/Networking/netkit/netkit-ftp-%{version}.tar.gz
@@ -32,6 +32,7 @@ Patch23: netkit-ftp-0.17-arg_max.patch
 Patch24: netkit-ftp-0.17-case.patch
 Patch25: netkit-ftp-0.17-chkmalloc.patch
 Patch26: netkit-ftp-0.17-man.patch
+Patch27: netkit-ftp-0.17-acct_ovl.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: glibc-devel, readline-devel, ncurses-devel
@@ -72,6 +73,7 @@ file transfers.
 %patch24 -p1 -b .case
 %patch25 -p1 -b .chkmalloc
 %patch26 -p1 -b .man
+%patch27 -p1 -b .acct_ovl
 
 %build
 sh configure --with-c-compiler=gcc --enable-ipv6
@@ -105,6 +107,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_mandir}/man5/netrc.*
 
 %changelog
+* Fri Sep 09 2011 Jiri Skala <jskala@redhat.com> - 0.17-54
+- fixes #737016 - ftp: off-by-one in account command parsing
+
 * Tue Mar 29 2011 Jiri Skala <jskala@redhat.com> - 0.17-53
 - fixes #673850 - ftp(1) manpage fixes
 
diff --git a/netkit-ftp-0.17-acct_ovl.patch b/netkit-ftp-0.17-acct_ovl.patch
new file mode 100644
index 0000000..ebff49c
--- /dev/null
+++ b/netkit-ftp-0.17-acct_ovl.patch
@@ -0,0 +1,13 @@
+diff -up netkit-ftp-0.17/ftp/cmds.c.acct_ovl netkit-ftp-0.17/ftp/cmds.c
+--- netkit-ftp-0.17/ftp/cmds.c.acct_ovl	2011-09-09 15:36:36.087956561 +0200
++++ netkit-ftp-0.17/ftp/cmds.c	2011-09-09 15:41:16.457495370 +0200
+@@ -1837,8 +1837,7 @@ account(int argc, char *argv[])
+ 		while (argc > 1) {
+ 			--argc;
+ 			++argv;
+-			strncat(buf, *argv, sizeof(buf)-strlen(buf));
+-			buf[sizeof(buf)-1] = 0;
++			strncat(buf, *argv, sizeof(buf)-strlen(buf)-1);
+ 		}
+ 		ap = buf;
+ 	}