diff --git a/[refs] b/[refs]
index 3f8a3da86b92..05fc6cfc32ee 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 017d79ef0073fdb170dcf185dc4c2456a304d659
+refs/heads/master: f417f5e4ba79a08e992c79a4bb84c8a8c5062017
diff --git a/trunk/drivers/isdn/i4l/isdn_tty.c b/trunk/drivers/isdn/i4l/isdn_tty.c
index 51dc60da333b..f013ee15327c 100644
--- a/trunk/drivers/isdn/i4l/isdn_tty.c
+++ b/trunk/drivers/isdn/i4l/isdn_tty.c
@@ -3515,7 +3515,7 @@ isdn_tty_parse_at(modem_info * info)
 {
 	atemu *m = &info->emu;
 	char *p;
-	char ds[40];
+	char ds[ISDN_MSNLEN];
 
 #ifdef ISDN_DEBUG_AT
 	printk(KERN_DEBUG "AT: '%s'\n", m->mdmcmd);
@@ -3594,7 +3594,7 @@ isdn_tty_parse_at(modem_info * info)
 						break;
 					case '3':
                                                 p++;
-                                                sprintf(ds, "\r\n%d", info->emu.charge);
+                                                snprintf(ds, sizeof(ds), "\r\n%d", info->emu.charge);
                                                 isdn_tty_at_cout(ds, info);
                                                 break;
 					default:;