--- ./telnet/telnet.c.orig	2002-02-17 20:02:03.000000000 -0800
+++ ./telnet/telnet.c	2005-07-28 19:00:18.000000000 -0700
@@ -1332,25 +1332,70 @@
 }
 
 
-unsigned char slc_reply[128];
+#define SLC_REPLY_SIZE 128
+unsigned char *slc_reply;
 unsigned char *slc_replyp;
+unsigned char *slc_replyend;
 
 	void
 slc_start_reply()
 {
+
+         slc_reply = (unsigned char *)malloc(SLC_REPLY_SIZE);
+         if (slc_reply == NULL) {
+ /*@*/           printf("slc_start_reply: malloc()/realloc() failed!!!\n");
+                 slc_reply = slc_replyp = slc_replyend = NULL;
+                 return;
+       }
+
 	slc_replyp = slc_reply;
+        slc_replyend = slc_reply + SLC_REPLY_SIZE;
 	*slc_replyp++ = IAC;
 	*slc_replyp++ = SB;
 	*slc_replyp++ = TELOPT_LINEMODE;
 	*slc_replyp++ = LM_SLC;
 }
 
+  static int
+  slc_assure_buffer(int want_len);
+ 
+        static int
+  slc_assure_buffer(int want_len)
+  {
+          if ((slc_replyp + want_len) >= slc_replyend) {
+                  int len;
+                int old_len = slc_replyp - slc_reply;
+                unsigned char *p;
+ 
+                  len = old_len
+                        + (want_len / SLC_REPLY_SIZE + 1) * SLC_REPLY_SIZE;
+                  p = (unsigned char *)realloc(slc_reply, len);
+                  if (p == NULL)
+                          free(slc_reply);
+                  slc_reply = p;
+                  if (slc_reply == NULL) {
+  /*@*/                   printf("slc_add_reply: realloc() failed!!!\n");
+                          slc_reply = slc_replyp = slc_replyend = NULL;
+                          return 1;
+                  }
+                  slc_replyp = slc_reply + old_len;
+                  slc_replyend = slc_reply + len;
+          }
+        return 0;
+  }
+ 
 	void
 slc_add_reply(func, flags, value)
 	unsigned char func;
 	unsigned char flags;
 	cc_t value;
 {
+        if (slc_assure_buffer(6))
+                return;
+ 
+        if (slc_replyp == NULL)
+                return;
+ 
 	if ((*slc_replyp++ = func) == IAC)
 		*slc_replyp++ = IAC;
 	if ((*slc_replyp++ = flags) == IAC)
@@ -1364,6 +1409,12 @@
 {
     int len;
 
+    if (slc_assure_buffer(2))
+	return;
+
+    if (slc_replyp == NULL)
+	return;
+
     *slc_replyp++ = IAC;
     *slc_replyp++ = SE;
     len = slc_replyp - slc_reply;
@@ -1483,7 +1534,7 @@
 	}
 }
 
-#define	OPT_REPLY_SIZE	256
+#define	OPT_REPLY_SIZE	1024
 unsigned char *opt_reply;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;
@@ -1517,10 +1568,38 @@
 env_opt_start_info()
 {
 	env_opt_start();
-	if (opt_replyp)
+	if (opt_replyp && (opt_replyp > opt_reply))
 	    opt_replyp[-1] = TELQUAL_INFO;
 }
 
+static int
+env_opt_assure_buffer(int want_len);
+
+	static int
+env_opt_assure_buffer(int want_len)
+{
+        if ((opt_replyp + want_len) >= opt_replyend) {
+		int len;
+		unsigned char *p;
+		int old_len = opt_replyp - opt_reply;
+
+		len = old_len
+			+ (want_len / OPT_REPLY_SIZE + 1) * OPT_REPLY_SIZE;
+		p = (unsigned char *)realloc(opt_reply, len);
+		if (p == NULL)
+			free(opt_reply);
+		opt_reply = p;
+		if (opt_reply == NULL) {
+/*@*/			printf("env_opt_add: realloc() failed!!!\n");
+			opt_reply = opt_replyp = opt_replyend = NULL;
+			return 1;
+		}
+		opt_replyp = opt_reply + old_len;
+		opt_replyend = opt_reply + len;
+	}
+	return 0;
+}
+
 	void
 env_opt_add(ep)
 	unsigned char *ep;
@@ -1543,25 +1622,12 @@
 		return;
 	}
 	vp = env_getvalue(ep);
-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
-				strlen((char *)ep) + 6 > opt_replyend)
-	{
-		int len;
-		unsigned char *p;
-		opt_replyend += OPT_REPLY_SIZE;
-		len = opt_replyend - opt_reply;
-		p = (unsigned char *)realloc(opt_reply, len);
-		if (p == NULL)
-			free(opt_reply);
-		opt_reply = p;
-		if (opt_reply == NULL) {
-/*@*/			printf("env_opt_add: realloc() failed!!!\n");
-			opt_reply = opt_replyp = opt_replyend = NULL;
-			return;
-		}
-		opt_replyp = opt_reply + len - (opt_replyend - opt_replyp);
-		opt_replyend = opt_reply + len;
-	}
+ 
+        /* use the double length in case it gots escaped */
+        if (env_opt_assure_buffer((vp ? strlen((char *)vp)*2 : 0) +
+                                strlen((char *)ep)*2 + 6))
+                return;
+
 	if (opt_welldefined((char *)ep))
 #ifdef	OLD_ENVIRON
 		if (telopt_environ == TELOPT_OLD_ENVIRON)
@@ -1618,8 +1684,14 @@
 {
 	int len;
 
+        if (opt_reply == NULL)          /*XXX*/
+                return;                 /*XXX*/
+
+
 	len = opt_replyp - opt_reply + 2;
 	if (emptyok || len > 6) {
+		if (env_opt_assure_buffer(2))
+			return;
 		*opt_replyp++ = IAC;
 		*opt_replyp++ = SE;
 		if (NETROOM() > len) {