diff -u wzdftpd-0.8.2/debian/changelog wzdftpd-0.8.2/debian/changelog
--- wzdftpd-0.8.2/debian/changelog
+++ wzdftpd-0.8.2/debian/changelog
@@ -1,3 +1,13 @@
+wzdftpd (0.8.2-2ubuntu2) gutsy; urgency=low
+
+  * debian/patches/90_CVE-2007-5300_off_by_one_fix.dpatch:
+    Fix off-by-one in wzd_login.c which leads to a remote
+    denial of service vulnerability (CVE-2007-5300) (LP: #151946)
+    (Fix provided by Nico Golde <nion@debian.org>)
+
+
+ -- Stephan Hermann <sh@sourcecode.de>  Fri, 12 Oct 2007 13:56:32 +0200
+
 wzdftpd (0.8.2-2ubuntu1) gutsy; urgency=low
 
   * Merge from Debian unstable, remaining changes:
diff -u wzdftpd-0.8.2/debian/patches/00list wzdftpd-0.8.2/debian/patches/00list
--- wzdftpd-0.8.2/debian/patches/00list
+++ wzdftpd-0.8.2/debian/patches/00list
@@ -3,0 +4 @@
+90_CVE-2007-5300_off_by_one_fix.dpatch
only in patch2:
unchanged:
--- wzdftpd-0.8.2.orig/debian/patches/90_CVE-2007-5300_off_by_one_fix.dpatch
+++ wzdftpd-0.8.2/debian/patches/90_CVE-2007-5300_off_by_one_fix.dpatch
@@ -0,0 +1,33 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 90_CVE-2007-5300_off_by_one_fix.dpatch by Stephan Hermann <sh@sourcecode.de>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad wzdftpd-0.8.2~/libwzd-core/wzd_login.c wzdftpd-0.8.2/libwzd-core/wzd_login.c
+--- wzdftpd-0.8.2~/libwzd-core/wzd_login.c	2007-04-26 09:22:02.000000000 +0200
++++ wzdftpd-0.8.2/libwzd-core/wzd_login.c	2007-10-12 13:55:09.324789666 +0200
+@@ -333,7 +333,7 @@
+     }
+ 
+     /* this replace the memset (bzero ?) some lines before */
+-    buffer[ret] = '\0';
++    buffer[ret-1] = '\0';
+ 
+     if (buffer[0]=='\0') continue;
+ 
+diff -urNad wzdftpd-0.8.2~/libwzd-core/wzd_protocol.c wzdftpd-0.8.2/libwzd-core/wzd_protocol.c
+--- wzdftpd-0.8.2~/libwzd-core/wzd_protocol.c	2007-06-14 12:58:05.000000000 +0200
++++ wzdftpd-0.8.2/libwzd-core/wzd_protocol.c	2007-10-12 13:55:42.826698831 +0200
+@@ -87,8 +87,8 @@
+   char buf[4];
+   if (!token || (length=strlen(token))==0)
+     return TOK_UNKNOWN;
+-  memcpy(buf,token,4);
+-  ascii_lower(buf,length);
++  memcpy(buf,token,sizeof(buf));
++  ascii_lower(buf,sizeof(buf));
+ 
+   /* TODO order the following by probability order */
+   if (length <= 4) {