[PATCH] Fix off-by-one error in telnet/telnet.c

Hi,

when sending the Terminal-Type during "subnegotiation", the terminating
TELNET command "SE" (end of subnegotiation parameters) is omitted when an
overlong terminal name is returned by gettermname(), because the length
calculation to check if the name fits into the buffer does not account
for the terminating NUL byte written by snprintf().

The attached patch fixes this.  Please let me know if you need copyright
assignment in order to use this trivial patch.  I'll do the paperwork if
necessary, but only if necessary.

BTW according to RFC 1091 and the IANA Terminal Type Names registry,
terminal names "may be up to 40 characters taken from the set of uppercase
letters, digits, and the two punctuation characters hyphen and slash.
It must start with a letter, and end with a letter or digit."  It might be
appropriate to check this and refuse to send a non-conforming telnet name.
Please let me know if you would like me to implement such functionality.

Best regards,
Erik
-- 
Bugs are like mushrooms - found one, look around for more...
                        -- Al Viro

diff --git a/telnet/telnet.c b/telnet/telnet.c
index c5b18c14..0211ffc6 100644
--- a/telnet/telnet.c
+++ b/telnet/telnet.c
@@ -858,7 +858,7 @@ suboption (void)
 	    }
 #endif /* defined(TN3270) */
 	  name = gettermname ();
-	  len = strlen (name) + 4 + 2;
+	  len = strlen (name) + 4 + 2 + 1;
 
 	  if ((len < NETROOM ()) && (len <= (int) sizeof (temp)))
 	    {