--- cgi.c.old	1998-09-15 11:28:26.000000000 +0200
+++ cgi.c	2004-06-08 21:42:54.000000000 +0200
@@ -245,15 +245,19 @@
 #endif
 
   /* execution doesn't get this far if PATH_TRANSLATED isn't set */
+
   pathtrans = getenv("PATH_TRANSLATED");
+  if (strlen(pathtrans) > 1001)
+    exit(117);
   slash = strrchr(pathtrans, '/');
   if (slash != NULL) {
     strncpy(fname, pathtrans, (slash - pathtrans) + 1);
     fname[slash - pathtrans + 1] = '\0';
-    strcat(fname, name);
+    strncat(fname, name, 1024 - strlen(fname));
   } else {
-    strcpy(fname, name);
+    strncpy(fname, name, sizeof(fname));
   }
+  fname[1023] = '\0';
   f = fopen(fname, "r");
   if (f == NULL)
     fprintf(yyout, "<p><b>include</b> - can't open file %s</p>\n", fname);