ntpd-bug2145.patch

--- ntp_control.c	2012-09-03 19:02:44.000000000 +0800
+++ ntp_control_new.c	2013-04-19 21:15:50.000000000 +0800
@@ -1843,41 +1843,66 @@
 		break;
 
 	case CS_VARLIST:
-		snprintf(str, sizeof(str), "%s=\"",
-			 sys_var[CS_VARLIST].text);
-		ctl_putdata(str, strlen(str), TRUE);
-
-		firstvarname = TRUE;
-		for (k = sys_var; !(EOV & k->flags); k++) {
-			if (PADDING & k->flags)
+	{
+		char buf[CTL_MAX_DATA_LEN];
+		//buffPointer, firstElementPointer, buffEndPointer
+		register char *buffp, *buffend;
+		register int firstVarName;
+		register const char *ss;
+		register int len;
+		register struct ctl_var *k;
+
+		buffp = buf;
+		buffend = buf + sizeof(buf);
+		if (buffp + strlen(sys_var[CS_VARLIST].text) + 4 > buffend)
+			break;	/* really long var name */
+
+		snprintf(buffp, sizeof(buf), "%s=\"",sys_var[CS_VARLIST].text);
+		buffp += strlen(buffp);
+		firstVarName = TRUE;
+		for (k = sys_var; !(k->flags & EOV); k++) {
+			if (k->flags & PADDING)
 				continue;
 			len = strlen(k->text);
-			if (0 == len)
-				continue;
-			if (!firstvarname)
-				ctl_putdata(",", 1, TRUE);
+			if (buffp+len+1 >= buffend)
+				break;
+			if (!firstVarName)
+				*buffp++ = ',';
 			else
-				firstvarname = FALSE;
-			ctl_putdata(k->text, len, TRUE);
+				firstVarName = FALSE;
+			memcpy(buffp, k->text, len);
+			buffp += len;
 		}
 
-		for (k = ext_sys_var; k && !(EOV & k->flags); k++) {
-			if (PADDING & k->flags)
+		for (k = ext_sys_var; k && !(k->flags & EOV); k++) {
+			if (k->flags & PADDING)
 				continue;
 			if (NULL == k->text)
 				continue;
-			ss = strchr(k->text, '=');
+			ss = strchr(k->text,'=');
 			if (NULL == ss)
 				len = strlen(k->text);
 			else
 				len = ss - k->text;
-			ctl_putdata(",", 1, TRUE);
-			ctl_putdata(k->text, len, TRUE);
+			if (buffp + len + 1 >= buffend)
+				break;
+			if (firstVarName) {
+				*buffp++ = ',';
+				firstVarName = FALSE;
+			}
+			memcpy(buffp, k->text,(unsigned)len);
+			buffp += len;
 		}
+		if (buffp+2 >= buffend)
+			break;
 
-		ctl_putdata("\"", 1, TRUE);
-		break;
+		*buffp++ = '"';
+		*buffp = '\0';
 
+		ctl_putdata(buf, (unsigned)( buffp - buf ), 0);
+		break;
+	}
+    
 	case CS_TAI:
 		if (sys_tai > 0)
 			ctl_putuint(sys_var[CS_TAI].text, sys_tai);