Limit TTY name to size of `buf' buffer

Patch from <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=221841>.
--- a/mingetty.c
+++ b/mingetty.c
@@ -138,11 +138,12 @@
 	int fd;
 
 	/* Set up new standard input. */
-	if (tty[0] == '/')
-		strcpy (buf, tty);
-	else {
+	if (tty[0] == '/') {
+		strncpy (buf, tty, sizeof(buf)-1);
+		buf[sizeof(buf)-1] = '\0';
+	} else {
 		strcpy (buf, "/dev/");
-		strcat (buf, tty);
+		strncat (buf, tty, sizeof(buf)-strlen(buf)-1);
 	}
 	/* There is always a race between this reset and the call to
 	   vhangup() that s.o. can use to get access to your tty. */
