Malformed vsprintf in bftpd

There is a malformed vsprintf in bftpd 1.0.12 in function sendstrf: int sendstrfint s, char format, ... .... vsprintfbuffer, format, val; when the function is called from NLIST command: else foo = 1; sendstrfs, entry-dname; This can be used to overflow the buffer of the vsprintf and execute...