Index: ChangeLog
===================================================================
RCS file: /sources/ratpoison/ratpoison/ChangeLog,v
retrieving revision 1.473
diff -u -p -r1.473 ChangeLog
--- ChangeLog	19 Jul 2007 09:15:18 -0000	1.473
+++ ChangeLog	14 Aug 2007 19:08:54 -0000
@@ -1,1 +1,8 @@
+2007-08-14  Bernhard R. Link  <address@hidden>
+
+	* src/main.c (xvsprintf): limit memory allocation
+	to 200K when vsnprintf return -1. (i.e. on pre-1999
+	systems not distinguising fatal errors and too small
+	buffer).
+
 2007-07-08  Bernhard R. Link  <address@hidden>
Index: src/main.c
===================================================================
RCS file: /sources/ratpoison/ratpoison/src/main.c,v
retrieving revision 1.134
diff -u -p -r1.134 main.c
--- src/main.c	18 Jul 2007 09:02:36 -0000	1.134
+++ src/main.c	14 Aug 2007 19:08:54 -0000
@@ -126,15 +126,24 @@ xvsprintf (char *fmt, va_list ap)
         return buffer;
       else if (nchars > -1)
         size = nchars + 1;
-      else
+      /* c99 says -1 is an error other than truncation,
+       * which thus will not go away with a larger buffer.
+       * To support older system but not making errors fatal
+       * (ratpoison will abort when trying to get too much memory otherwise),
+       * try to increase a bit but not too much: */
+      else if (size < 102400)
         size *= 2;
+      else
+	{
+	  free(buffer);
+	  break;
+	}
 
       /* Resize the buffer and try again. */
       buffer = (char *)xrealloc (buffer, size);
     }
 
-  /* Never gets here. */
-  return NULL;
+  return xstrdup("<FAILURE>");
 }
 
 /* Return a new string based on fmt. */