diff --git a/bin/sh/parser.c b/bin/sh/parser.c
index e72a6f1c7e2e..26c1362c7d2a 100644
--- a/bin/sh/parser.c
+++ b/bin/sh/parser.c
@@ -1610,7 +1610,6 @@ readtoken1(int firstc, char const *initialsyntax, const char *eofmark,
  */
 
 parsesub: {
-	char buf[10];
 	int subtype;
 	int typeloc;
 	int flags;
@@ -1654,12 +1653,15 @@ parsesub: {
 			    strncmp(out - length, "LINENO", length) == 0) {
 				/* Replace the variable name with the
 				 * current line number. */
+				STADJUST(-6, out);
+				CHECKSTRSPACE(11, out);
 				linno = plinno;
 				if (funclinno != 0)
 					linno -= funclinno - 1;
-				snprintf(buf, sizeof(buf), "%d", linno);
-				STADJUST(-6, out);
-				STPUTS(buf, out);
+				length = snprintf(out, 11, "%d", linno);
+				if (length > 10)
+					length = 10;
+				out += length;
 				flags |= VSLINENO;
 			}
 		} else if (is_digit(c)) {