From 9ce49ce6289b0f60adfead4a30e7006423ad034b Mon Sep 17 00:00:00 2001
From: claudio <claudio@openbsd.org>
Date: Tue, 4 Nov 2025 18:48:41 +0000
Subject: [PATCH] Reduce buffer size by 1 to keep space for the '\0' added
 after the loop.

Fixes CID 492348
OK tb@
---
 usr.sbin/bgplgd/qs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/usr.sbin/bgplgd/qs.c b/usr.sbin/bgplgd/qs.c
index 7dde7010800..a5a9a9323c1 100644
--- a/usr.sbin/bgplgd/qs.c
+++ b/usr.sbin/bgplgd/qs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qs.c,v 1.7 2024/12/03 10:38:06 claudio Exp $ */
+/*	$OpenBSD: qs.c,v 1.8 2025/11/04 18:48:41 claudio Exp $ */
 /*
  * Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
  *
@@ -81,7 +81,7 @@ urldecode(const char *s, size_t len)
 	size_t i, blen = 0;
 
 	for (i = 0; i < len; i++) {
-		if (blen >= sizeof(buf))
+		if (blen >= sizeof(buf) - 1)
 			return NULL;
 		if (s[i] == '+') {
 			buf[blen++] = ' ';