diff -ruN htpdate/htpdate.c htpdate.new/htpdate.c
--- htpdate/htpdate.c	2010-11-30 14:53:31.637209639 -0600
+++ htpdate.new/htpdate.c	2010-11-30 15:48:25.647523022 -0600
@@ -158,7 +158,7 @@
 	char				url[URLSIZE] = { '\0' };
 	char				*pdate = NULL;
 	int 				error = -1; 	/* used when returning non-zero return values */
-	
+	ssize_t				buffer_size = 0;
 
 	/* Connect to web server via proxy server or directly */
 	memset( &hints, 0, sizeof(hints) );
@@ -244,8 +244,10 @@
 	/* Receive data from the web server
 	   The return code from recv() is the number of bytes received
 	*/
-	if ( recv(server_s, buffer, BUFFERSIZE, 0) != -1 ) {
-
+	buffer_size = recv(server_s, buffer, BUFFERSIZE - 1, 0);
+	if ( buffer_size >= 0 ) {
+		/* NUL terminate the string data. */
+		buffer[buffer_size] = '\0';
 		/* Assuming that network delay (server->htpdate) is neglectable,
 		   the received web server time "should" match the local time.
 
@@ -264,9 +266,12 @@
 		rtt = ( timeofday.tv_sec - rtt ) * 1000000 + \
 			timeofday.tv_usec - when;
 
-		/* Look for the line that contains Date: */
-		if ( (pdate = strstr(buffer, "Date: ")) != NULL ) {
+		/* Look for the line that contains Date: and has enough data. */
+		pdate = strstr(buffer, "Date: ");
+		/* strlen("Date: ...") must be >= 11. */
+		if ( pdate != NULL && strlen(pdate) >= 11 ) {
 			strncpy(remote_time, pdate + 11, 24);
+			remote_time[24] = '\0';
 			recvdvalidresp = 1;
 
 			if ( strptime( remote_time, "%d %b %Y %T", &tm) != NULL) {