diff --git a/lib/ChangeLog b/lib/ChangeLog
index 750e310..7955f09 100644
--- a/lib/ChangeLog
+++ b/lib/ChangeLog
@@ -1,5 +1,11 @@
 2005-01-28 Andrew J. Schorr <ajschorr@alumni.princeton.edu>
 
+	* lib/buffer.h: Document behavior of buffer_getstr function.
+	* lib/buffer.c: (buffer_getstr) Fix bug: must handle case where
+	  the string extends beyond the head struct buffer_data.
+
+2005-01-28 Andrew J. Schorr <ajschorr@alumni.princeton.edu>
+
 	* lib/command.h: Document behavior of argv_concat function.
 	* lib/command.c: (argv_concat) Calculate total string length first so
 	  we can call malloc just once (instead of realloc'ing to add each
diff --git a/lib/buffer.c b/lib/buffer.c
index 296fd14..60048bc 100644
--- a/lib/buffer.c
+++ b/lib/buffer.c
@@ -88,7 +88,23 @@
 char *
 buffer_getstr (struct buffer *b)
 {
-  return strdup ((char *)b->head->data);
+  size_t totlen = 0;
+  struct buffer_data *data;
+  char *s;
+  char *p;
+
+  for (data = b->head; data; data = data->next)
+    totlen += data->cp - data->sp;
+  if (!(s = malloc(totlen+1)))
+    return NULL;
+  p = s;
+  for (data = b->head; data; data = data->next)
+    {
+      memcpy(p, data->data + data->sp, data->cp - data->sp);
+      p += data->cp - data->sp;
+    }
+  *p = '\0';
+  return s;
 }
 
 /* Return 1 if buffer is empty. */
diff --git a/lib/buffer.h b/lib/buffer.h
index 65b8a8c..c3787d7 100644
--- a/lib/buffer.h
+++ b/lib/buffer.h
@@ -65,7 +65,14 @@
 struct buffer *buffer_new (size_t);
 int buffer_write (struct buffer *, const void *, size_t);
 void buffer_free (struct buffer *);
+
+/* Combine all accumulated (and unflushed) data inside the buffer into a
+   single NUL-terminated string allocated using malloc (N.B. should be changed
+   to use XMALLOC(MTYPE_TMP)).  Note that this function does not alter
+   the state of the buffer, so the data is still inside waiting to be
+   flushed. */
 char *buffer_getstr (struct buffer *);
+
 int buffer_putc (struct buffer *, u_char);
 int buffer_putstr (struct buffer *, const char *);
 void buffer_reset (struct buffer *);