diff --git a/ChangeLog b/ChangeLog
index e443f1c62..e33007ac5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,9 @@
    - markus@cvs.openbsd.org 2001/02/10 12:52:02
      [auth2.c]
      offer passwd before s/key
+   - markus@cvs.openbsd.org 2001/02/8 22:37:10
+     [canohost.c]
+     remove last call to sprintf; ok deraadt@
 
 20010210
  - (djm) Sync sftp and scp stuff from OpenBSD:
@@ -3789,4 +3792,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.714 2001/02/10 21:31:53 mouring Exp $
+$Id: ChangeLog,v 1.715 2001/02/10 21:34:46 mouring Exp $
diff --git a/canohost.c b/canohost.c
index 8f4bebda2..d47940b1b 100644
--- a/canohost.c
+++ b/canohost.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: canohost.c,v 1.21 2001/02/08 19:30:51 itojun Exp $");
+RCSID("$OpenBSD: canohost.c,v 1.22 2001/02/08 22:37:10 markus Exp $");
 
 #include "packet.h"
 #include "xmalloc.h"
@@ -142,10 +142,10 @@ get_remote_hostname(int socket, int reverse_mapping_check)
 void
 check_ip_options(int socket, char *ipaddr)
 {
-	u_char options[200], *ucp;
-	char text[1024], *cp;
+	u_char options[200];
+	char text[sizeof(options) * 3 + 1];
 	socklen_t option_size;
-	int ipproto;
+	int i, ipproto;
 	struct protoent *ip;
 
 	if ((ip = getprotobyname("ip")) != NULL)
@@ -155,10 +155,10 @@ check_ip_options(int socket, char *ipaddr)
 	option_size = sizeof(options);
 	if (getsockopt(socket, ipproto, IP_OPTIONS, (void *)options,
 	    &option_size) >= 0 && option_size != 0) {
-		cp = text;
-		/* Note: "text" buffer must be at least 3x as big as options. */
-		for (ucp = options; option_size > 0; ucp++, option_size--, cp += 3)
-			sprintf(cp, " %2.2x", *ucp);
+		text[0] = '\0';
+		for (i = 0; i < option_size; i++)
+			snprintf(text + i*3, sizeof(text) - i*3,
+			    " %2.2x", options[i]);
 		log("Connection from %.100s with IP options:%.800s",
 		    ipaddr, text);
 		packet_disconnect("Connection from %.100s with IP options:%.800s",