--- cups-1.1.17/filter/hpgl-input.c.str1024	2002-03-01 19:53:32.000000000 +0000
+++ cups-1.1.17/filter/hpgl-input.c	2004-12-17 10:19:51.378737854 +0000
@@ -54,7 +54,8 @@
 		ch,		/* Current char */
 		done,		/* Non-zero when the current command is read */
 		i;		/* Looping var */
-  char		buf[262144];	/* String buffer */
+  char		buf[262144],	/* String buffer */
+		*bufptr;	/* Pointer into buffer */
   static param_t p[MAX_PARAMS];	/* Parameter buffer */
 
 
@@ -115,9 +116,12 @@
 
   if (strcasecmp(name, "LB") == 0)
   {
-    for (i = 0; (ch = getc(fp)) != StringTerminator; i ++)
-      buf[i] = ch;
-    buf[i] = '\0';
+    bufptr = buf;
+    while ((ch = getc(fp)) != StringTerminator)
+      if (bufptr < (buf + sizeof(buf) - 1))
+        *bufptr++ = ch;
+    *bufptr = '\0';
+
     p[num_params].type         = PARAM_STRING;
     p[num_params].value.string = strdup(buf);
     num_params ++;
@@ -142,11 +146,12 @@
   }
   else if (strcasecmp(name, "PE") == 0)
   {
-    for (i = 0; i < (sizeof(buf) - 1); i ++)
-      if ((buf[i] = getc(fp)) == ';')
-        break;
+    bufptr = buf;
+    while ((ch = getc(fp)) != ';')
+      if (bufptr < (buf + sizeof(buf) - 1))
+        *bufptr++ = ch;
+    *bufptr = '\0';
 
-    buf[i] = '\0';
     p[num_params].type         = PARAM_STRING;
     p[num_params].value.string = strdup(buf);
     num_params ++;