Index: usr.sbin/xntpd/xntpd/ntp_control.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/xntpd/xntpd/Attic/ntp_control.c,v
retrieving revision 1.6
diff -u -r1.6 ntp_control.c
--- usr.sbin/xntpd/xntpd/ntp_control.c	1995/05/30 03:54:35	1.6
+++ usr.sbin/xntpd/xntpd/ntp_control.c	2001/04/06 19:36:45
@@ -1684,7 +1684,7 @@
 	/*
 	 * Delete leading commas and white space
 	 */
-	while (reqpt < reqend && (*reqpt == ',' || isspace(*reqpt))) {
+	while (reqpt < reqend && (*reqpt == ',' || isspace((unsigned char)*reqpt))) {
 		reqpt++;
 	}
 
@@ -1708,7 +1708,7 @@
 				tp++;
 			}
 			if ((*tp == '\0') || (*tp == '=')) {
-				while (cp < reqend && isspace(*cp))
+				while (cp < reqend && isspace((unsigned char)*cp))
 					cp++;
 				if (cp == reqend || *cp == ',') {
 					buf[0] = '\0';
@@ -1721,14 +1721,18 @@
 				if (*cp == '=') {
 					cp++;
 					tp = buf;
-					while (cp < reqend && isspace(*cp))
+					while (cp < reqend && isspace((unsigned char)*cp))
 						cp++;
-					while (cp < reqend && *cp != ',')
+					while (cp < reqend && *cp != ',') {
 						*tp++ = *cp++;
+						if (tp >= buf + sizeof(buf))
+							return (0);
+					}
 					if (cp < reqend)
 						cp++;
 					*tp = '\0';
-					while (isspace(*(tp-1)))
+					while (tp != buf &&
+					    isspace((unsigned char)*(tp-1)))
 						*(--tp) = '\0';
 					reqpt = cp;
 					*data = buf;