From 23417e56ea59f9fc73d86a70871d977eda9d16c3 Mon Sep 17 00:00:00 2001
From: Brian Somers <brian@FreeBSD.org>
Date: Tue, 8 Feb 2005 10:38:24 +0000
Subject: [PATCH] Use the correct length when copying trailing data!!

PR:		77104
Submitted by:	Martin Birgmeier martin at email dot aon dot at
MFC after:	3 days
---
 usr.sbin/ppp/command.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr.sbin/ppp/command.c b/usr.sbin/ppp/command.c
index 156fa8c8bc9..3be394649f7 100644
--- a/usr.sbin/ppp/command.c
+++ b/usr.sbin/ppp/command.c
@@ -455,7 +455,7 @@ subst(char *tgt, const char *oldstr, const char *newstr)
       tgt = ntgt;
     }
     if (lnewstr > loldstr)
-      bcopy(word + loldstr, word + lnewstr, ltgt - pos - loldstr);
+      bcopy(word + loldstr, word + lnewstr, ltgt - pos - lnewstr);
     bcopy(newstr, word, lnewstr);
   } while ((word = strstrword(word, oldstr)));