diff -urp telnet-3.0.orig/usr.bin/telnet/telnet.c telnet-3.0-owl-env/usr.bin/telnet/telnet.c
--- telnet-3.0.orig/usr.bin/telnet/telnet.c	Sat Nov  3 00:07:53 2001
+++ telnet-3.0-owl-env/usr.bin/telnet/telnet.c	Thu Mar 17 13:00:57 2005
@@ -34,6 +34,8 @@
  * SUCH DAMAGE.
  */
 
+#define _GNU_SOURCE
+
 #include "telnet_locl.h"
 #include <curses.h>
 #include <term.h>
@@ -857,10 +859,17 @@ suboption()
 	if (SB_EOF())
 	    return;
 	if (SB_GET() == TELQUAL_SEND) {
-	    unsigned char temp[50], *dp;
-	    int len;
+	    unsigned char *temp, *dp;
+	    int len = -1;
 
-	    if ((dp = env_getvalue((unsigned char *)"DISPLAY")) == NULL) {
+	    if ((dp = env_getvalue((unsigned char *)"DISPLAY"))) {
+		char *t;
+		len = asprintf(&t, "%c%c%c%c%s%c%c",
+			       IAC, SB, TELOPT_XDISPLOC,
+			       TELQUAL_IS, dp, IAC, SE);
+		temp = (unsigned char *)t;
+	    }
+	    if (len < 0) {
 		/*
 		 * Something happened, we no longer have a DISPLAY
 		 * variable.  So, turn off the option.
@@ -868,16 +877,13 @@ suboption()
 		send_wont(TELOPT_XDISPLOC, 1);
 		break;
 	    }
-	    snprintf((char *)temp, sizeof(temp),
-		    "%c%c%c%c%s%c%c", IAC, SB, TELOPT_XDISPLOC,
-		    TELQUAL_IS, dp, IAC, SE);
-	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 
 	    if (len < NETROOM()) {
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', temp+2, len - 2);
 	    }
 /*@*/	    else printf("lm_will: not enough room in buffer\n");
+	    free(temp);
 	}
 	break;