Fix & expansion (from pw_gecos field), sizeof buf used when

buf is pointer, not array, buflen must be used instead.
Charlie & from root name was expanded to junk as result.

usr.sbin/sendmail/src/util.c

@@ -418,7 +418,7 @@ buildfname(gecos, login, buf, buflen)
 	{
 		if (*p == '&')
 		{
-			snprintf(bp, SPACELEFT(buf, bp), "%s", login);
+			snprintf(bp, buflen - (bp - buf), "%s", login);
 			*bp = toupper(*bp);
 			bp += strlen(bp);
 		}