diff --git a/ospfd/ChangeLog b/ospfd/ChangeLog
index b33ca43..41453bf 100644
--- a/ospfd/ChangeLog
+++ b/ospfd/ChangeLog
@@ -1,5 +1,14 @@
 2005-11-16 Andrew J. Schorr <ajschorr@alumni.princeton.edu>
 
+	* ospf_dump.h: Define OSPF_TIME_DUMP_SIZE as appropriate buffer size
+	  for use with ospf_timer_dump and ospf_timeval_dump.
+	* ospf_vty.c: Change all buffer sizes used with ospf_timer_dump and
+	  ospf_timeval_dump to have size OSPF_TIME_DUMP_SIZE.
+	  (show_ip_ospf_interface_sub) Fix possible buffer overflow in
+	  call to ospf_timer_dump.
+
+2005-11-16 Andrew J. Schorr <ajschorr@alumni.princeton.edu>
+
 	* ospf_ism.h: (OSPF_ISM_TIMER_OFF) Improve macro syntax by enclosing
 	  in 'do {...} while(0)'.
 
diff --git a/ospfd/ospf_dump.h b/ospfd/ospf_dump.h
index e24244e..fb81371 100644
--- a/ospfd/ospf_dump.h
+++ b/ospfd/ospf_dump.h
@@ -137,4 +137,7 @@
 extern void ospf_lsa_header_dump (struct lsa_header *);
 extern void debug_init (void);
 
+/* Appropriate buffer size to use with ospf_timer_dump and ospf_timeval_dump: */
+#define OSPF_TIME_DUMP_SIZE	16
+
 #endif /* _ZEBRA_OSPF_DUMP_H */
diff --git a/ospfd/ospf_vty.c b/ospfd/ospf_vty.c
index e28a89c..de021bc 100644
--- a/ospfd/ospf_vty.c
+++ b/ospfd/ospf_vty.c
@@ -2520,7 +2520,7 @@
   /* Stub-router state for this area */
   if (CHECK_FLAG (area->stub_router_state, OSPF_AREA_IS_STUB_ROUTED))
     {
-      char timebuf[9];
+      char timebuf[OSPF_TIME_DUMP_SIZE];
       vty_out (vty, "   Originating stub / maximum-distance Router-LSA%s",
                VTY_NEWLINE);
       if (CHECK_FLAG(area->stub_router_state, OSPF_AREA_ADMIN_STUB_ROUTED))
@@ -2592,7 +2592,7 @@
   struct ospf_area * area;
   struct ospf *ospf;
   struct timeval result;
-  char timebuf[13]; /* XX:XX:XX.XXX(nul) */
+  char timebuf[OSPF_TIME_DUMP_SIZE];
 
   /* Check OSPF is enable. */
   ospf = ospf_lookup ();
@@ -2706,7 +2706,6 @@
   int is_up;
   struct ospf_neighbor *nbr;
   struct route_node *rn;
-  char buf[9];
 
   /* Is interface up? */
   vty_out (vty, "%s is %s%s", ifp->name,
@@ -2818,14 +2817,9 @@
       
       if (OSPF_IF_PARAM (oi, passive_interface) == OSPF_IF_ACTIVE)
         {
-          int timer_slen = 9; /* length of "hh:mm:ss(nul)" */
-          
-          /* for fast hello we also want to see the .XXXX ms part */
-          if (OSPF_IF_PARAM (oi, fast_hello))
-            timer_slen += 5;
-          
+	  char timebuf[OSPF_TIME_DUMP_SIZE];
 	  vty_out (vty, "    Hello due in %s%s",
-		   ospf_timer_dump (oi->t_hello, buf, timer_slen), 
+		   ospf_timer_dump (oi->t_hello, timebuf, sizeof(timebuf)), 
 		   VTY_NEWLINE);
         }
       else /* OSPF_IF_PASSIVE is set */
@@ -2884,7 +2878,7 @@
   struct route_node *rn;
   struct ospf_neighbor *nbr;
   char msgbuf[16];
-  char timebuf[14];
+  char timebuf[OSPF_TIME_DUMP_SIZE];
 
   for (rn = route_top (oi->nbrs); rn; rn = route_next (rn))
     if ((nbr = rn->info))
@@ -3035,7 +3029,7 @@
 show_ip_ospf_nbr_nbma_detail_sub (struct vty *vty, struct ospf_interface *oi,
 				  struct ospf_nbr_nbma *nbr_nbma)
 {
-  char timebuf[9];
+  char timebuf[OSPF_TIME_DUMP_SIZE];
 
   /* Show neighbor ID. */
   vty_out (vty, " Neighbor %s,", "-");
@@ -3069,7 +3063,7 @@
 show_ip_ospf_neighbor_detail_sub (struct vty *vty, struct ospf_interface *oi,
 				  struct ospf_neighbor *nbr)
 {
-  char timebuf[9];
+  char timebuf[OSPF_TIME_DUMP_SIZE];
 
   /* Show neighbor ID. */
   if (nbr->state == NSM_Attempt && nbr->router_id.s_addr == 0)