04a9bc
diff -rup netkit-ftp-0.17/ftp/ruserpass.c netkit-ftp-0.17-new/ftp/ruserpass.c
04a9bc
--- netkit-ftp-0.17/ftp/ruserpass.c	2012-10-29 15:11:10.593841089 +0100
04a9bc
+++ netkit-ftp-0.17-new/ftp/ruserpass.c	2012-10-29 15:13:14.379822697 +0100
04a9bc
@@ -58,7 +58,8 @@ static int token(void);
04a9bc
 #define	ID	10
04a9bc
 #define	MACH	11
04a9bc
 
04a9bc
-static char tokval[100];
04a9bc
+#define MAXTOKENLEN 4096
04a9bc
+static char tokval[MAXTOKENLEN];
04a9bc
 
04a9bc
 static struct toktab {
04a9bc
 	const char *tokstr;
04a9bc
@@ -249,13 +250,16 @@ bad:
04a9bc
 	return(-1);
04a9bc
 }
04a9bc
 
04a9bc
-static 
04a9bc
+static
04a9bc
 int
04a9bc
 token(void)
04a9bc
 {
04a9bc
 	char *cp;
04a9bc
 	int c;
04a9bc
 	struct toktab *t;
04a9bc
+	size_t toklen = 0;
04a9bc
+	int showwarn = 1;
04a9bc
+	int quote = 0;
04a9bc
 
04a9bc
 	if (feof(cfile))
04a9bc
 		return (0);
04a9bc
@@ -266,20 +270,32 @@ token(void)
04a9bc
 		return (0);
04a9bc
 	cp = tokval;
04a9bc
 	if (c == '"') {
04a9bc
-		while ((c = getc(cfile)) != EOF && c != '"') {
04a9bc
-			if (c == '\\')
04a9bc
-				c = getc(cfile);
04a9bc
-			*cp++ = c;
04a9bc
-		}
04a9bc
-	} else {
04a9bc
+		quote = 1;
04a9bc
+	}
04a9bc
+	else {
04a9bc
 		*cp++ = c;
04a9bc
-		while ((c = getc(cfile)) != EOF
04a9bc
-		    && c != '\n' && c != '\t' && c != ' ' && c != ',') {
04a9bc
-			if (c == '\\')
04a9bc
-				c = getc(cfile);
04a9bc
-			*cp++ = c;
04a9bc
+		toklen++;
04a9bc
+	}
04a9bc
+	while ((c = getc(cfile)) != EOF) {
04a9bc
+		if (c == '"')
04a9bc
+			break;
04a9bc
+		if (c == '\\')
04a9bc
+			c = getc(cfile);
04a9bc
+		if (!quote && (c == '\n' || c == '\t' || c == ' ' || c == ','))
04a9bc
+			break;
04a9bc
+		if (toklen >= MAXTOKENLEN) {
04a9bc
+			if (showwarn) {
04a9bc
+				fprintf(stderr,
04a9bc
+						"Warning: .netrc token too long, will be trunctated to %zd characters\n",
04a9bc
+						toklen);
04a9bc
+				showwarn = 0;
04a9bc
+			}
04a9bc
+			continue;
04a9bc
 		}
04a9bc
+		*cp++ = c;
04a9bc
+		toklen++;
04a9bc
 	}
04a9bc
+
04a9bc
 	*cp = 0;
04a9bc
 	if (tokval[0] == 0)
04a9bc
 		return (0);