Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/lib/libc/gen/getcap.c,v
retrieving revision 1.33
retrieving revision 1.33.4.3
diff -u -p -r1.33 -r1.33.4.3
--- src/lib/libc/gen/getcap.c	2000/06/02 13:13:07	1.33
+++ src/lib/libc/gen/getcap.c	2002/08/13 00:59:50	1.33.4.3
@@ -1,4 +1,4 @@
-/*	$NetBSD: getcap.c,v 1.33 2000/06/02 13:13:07 itojun Exp $	*/
+/*	$NetBSD: getcap.c,v 1.33.4.3 2002/08/13 00:59:50 nathanw Exp $	*/
 
 /*-
  * Copyright (c) 1992, 1993
@@ -41,12 +41,13 @@
 #if 0
 static char sccsid[] = "@(#)getcap.c	8.3 (Berkeley) 3/25/94";
 #else
-__RCSID("$NetBSD: getcap.c,v 1.33 2000/06/02 13:13:07 itojun Exp $");
+__RCSID("$NetBSD: getcap.c,v 1.33.4.3 2002/08/13 00:59:50 nathanw Exp $");
 #endif
 #endif /* LIBC_SCCS and not lint */
 
 #include "namespace.h"
 #include <sys/types.h>
+#include <sys/param.h>
 
 #include <assert.h>
 #include <ctype.h>
@@ -251,7 +252,7 @@ getent(cap, len, db_array, fd, name, dep
 	size_t clen;
 	char *record, *cbuf, *newrecord;
 	int tc_not_resolved;
-	char pbuf[_POSIX_PATH_MAX];
+	char pbuf[MAXPATHLEN];
 	
 	_DIAGASSERT(cap != NULL);
 	_DIAGASSERT(len != NULL);
@@ -708,7 +709,10 @@ cgetmatch(buf, name)
 		/*
 		 * Match failed, skip to next name in record.
 		 */
-		bp--;	/* a '|' or ':' may have stopped the match */
+		if (bp > buf)
+			bp--;	/* a '|' or ':' may have stopped the match */
+		else
+			return (-1);
 		for (;;)
 			if (*bp == '\0' || *bp == ':')
 				return (-1);	/* match failed totally */
@@ -819,6 +823,8 @@ cgetnext(bp, db_array)
 		/* 
 		 * Line points to a name line.
 		 */
+		if (len > sizeof(nbuf))
+			return -1;
 		done = 0;
 		np = nbuf;
 		for (;;) {
@@ -850,6 +856,8 @@ cgetnext(bp, db_array)
 					line[len - 1] = '\0';
 			}
 		}
+		if (len > sizeof(buf))
+			return -1;
 		rp = buf;
 		for(cp = nbuf; *cp != '\0'; cp++)
 			if (*cp == '|' || *cp == ':')