09d58c
diff -rup netkit-ftp-0.17/ftp/ruserpass.c netkit-ftp-0.17-new/ftp/ruserpass.c
09d58c
--- netkit-ftp-0.17/ftp/ruserpass.c	2012-10-29 15:11:10.593841089 +0100
09d58c
+++ netkit-ftp-0.17-new/ftp/ruserpass.c	2012-10-29 15:13:14.379822697 +0100
09d58c
@@ -58,7 +58,8 @@ static int token(void);
09d58c
 #define	ID	10
09d58c
 #define	MACH	11
09d58c
 
09d58c
-static char tokval[100];
09d58c
+#define MAXTOKENLEN 4096
09d58c
+static char tokval[MAXTOKENLEN];
09d58c
 
09d58c
 static struct toktab {
09d58c
 	const char *tokstr;
09d58c
@@ -249,13 +250,16 @@ bad:
09d58c
 	return(-1);
09d58c
 }
09d58c
 
09d58c
-static 
09d58c
+static
09d58c
 int
09d58c
 token(void)
09d58c
 {
09d58c
 	char *cp;
09d58c
 	int c;
09d58c
 	struct toktab *t;
09d58c
+	size_t toklen = 0;
09d58c
+	int showwarn = 1;
09d58c
+	int quote = 0;
09d58c
 
09d58c
 	if (feof(cfile))
09d58c
 		return (0);
09d58c
@@ -266,20 +270,32 @@ token(void)
09d58c
 		return (0);
09d58c
 	cp = tokval;
09d58c
 	if (c == '"') {
09d58c
-		while ((c = getc(cfile)) != EOF && c != '"') {
09d58c
-			if (c == '\\')
09d58c
-				c = getc(cfile);
09d58c
-			*cp++ = c;
09d58c
-		}
09d58c
-	} else {
09d58c
+		quote = 1;
09d58c
+	}
09d58c
+	else {
09d58c
 		*cp++ = c;
09d58c
-		while ((c = getc(cfile)) != EOF
09d58c
-		    && c != '\n' && c != '\t' && c != ' ' && c != ',') {
09d58c
-			if (c == '\\')
09d58c
-				c = getc(cfile);
09d58c
-			*cp++ = c;
09d58c
+		toklen++;
09d58c
+	}
09d58c
+	while ((c = getc(cfile)) != EOF) {
09d58c
+		if (c == '"')
09d58c
+			break;
09d58c
+		if (c == '\\')
09d58c
+			c = getc(cfile);
09d58c
+		if (!quote && (c == '\n' || c == '\t' || c == ' ' || c == ','))
09d58c
+			break;
09d58c
+		if (toklen >= MAXTOKENLEN) {
09d58c
+			if (showwarn) {
09d58c
+				fprintf(stderr,
09d58c
+						"Warning: .netrc token too long, will be trunctated to %zd characters\n",
09d58c
+						toklen);
09d58c
+				showwarn = 0;
09d58c
+			}
09d58c
+			continue;
09d58c
 		}
09d58c
+		*cp++ = c;
09d58c
+		toklen++;
09d58c
 	}
09d58c
+
09d58c
 	*cp = 0;
09d58c
 	if (tokval[0] == 0)
09d58c
 		return (0);