===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/expand/expand.c,v
retrieving revision 1.9
retrieving revision 1.10
diff -c -r1.9 -r1.10
*** src/usr.bin/expand/expand.c	2005/03/08 23:30:50	1.9
--- src/usr.bin/expand/expand.c	2005/12/27 19:19:55	1.10
***************
*** 1,4 ****
! /*	$OpenBSD: expand.c,v 1.9 2005/03/08 23:30:50 cloder Exp $	*/
  /*	$NetBSD: expand.c,v 1.5 1995/09/02 06:19:46 jtc Exp $	*/
  
  /*
--- 1,4 ----
! /*	$OpenBSD: expand.c,v 1.10 2005/12/27 19:19:55 moritz Exp $	*/
  /*	$NetBSD: expand.c,v 1.5 1995/09/02 06:19:46 jtc Exp $	*/
  
  /*
***************
*** 40,46 ****
  #if 0
  static const char sccsid[] = "@(#)expand.c	8.1 (Berkeley) 6/9/93";
  #endif
! static const char rcsid[] = "$OpenBSD: expand.c,v 1.9 2005/03/08 23:30:50 cloder Exp $";
  #endif /* not lint */
  
  #include <stdio.h>
--- 40,46 ----
  #if 0
  static const char sccsid[] = "@(#)expand.c	8.1 (Berkeley) 6/9/93";
  #endif
! static const char rcsid[] = "$OpenBSD: expand.c,v 1.10 2005/12/27 19:19:55 moritz Exp $";
  #endif /* not lint */
  
  #include <stdio.h>
***************
*** 160,165 ****
--- 160,167 ----
  		}
  		if (nstops > 0 && i <= tabstops[nstops-1])
  			goto bad;
+ 		if (nstops >= sizeof(tabstops) / sizeof(tabstops[0]))
+ 			errx(1, "Too many tab stops");
  		tabstops[nstops++] = i;
  		if (*cp == 0)
  			break;