2005-07-26 Andrew J. Schorr <ajschorr@alumni.princeton.edu>

	* prefix.c: (ip_masklen) While loop should test that 'pnt' pointer is
	  in range before dereferencing it.

	[backport candidate]
diff --git a/lib/ChangeLog b/lib/ChangeLog
index aed2874..f67f2c1 100644
--- a/lib/ChangeLog
+++ b/lib/ChangeLog
@@ -1,3 +1,8 @@
+2005-07-26 Andrew J. Schorr <ajschorr@alumni.princeton.edu>
+
+	* prefix.c: (ip_masklen) While loop should test that 'pnt' pointer is
+	  in range before dereferencing it.
+
 2005-06-24 Pawel Worach <pawel.worach@gmail.com>
 
 	* getopt.h: add further tests for full getopt declaration on
diff --git a/lib/prefix.c b/lib/prefix.c
index b4347dd..1806ac4 100644
--- a/lib/prefix.c
+++ b/lib/prefix.c
@@ -292,7 +292,7 @@
   pnt = (u_char *) &netmask;
   end = pnt + 4;
 
-  while ((*pnt == 0xff) && pnt < end)
+  while ((pnt < end) && (*pnt == 0xff))
     {
       len+= 8;
       pnt++;