diff --git a/ncurses-5.6-20070812-fieldbuf.patch b/ncurses-5.6-20070812-fieldbuf.patch
new file mode 100644
index 0000000..53be9e4
--- /dev/null
+++ b/ncurses-5.6-20070812-fieldbuf.patch
@@ -0,0 +1,12 @@
+diff -up ncurses-5.6/form/frm_driver.c.fieldbuf ncurses-5.6/form/frm_driver.c
+--- ncurses-5.6/form/frm_driver.c.fieldbuf	2007-10-09 12:35:24.000000000 +0200
++++ ncurses-5.6/form/frm_driver.c	2007-10-09 13:24:37.000000000 +0200
+@@ -4476,7 +4476,7 @@ field_buffer(const FIELD *field, int buf
+ 	{
+ 	  wclear(field->working);
+ 	  mvwadd_wchnstr(field->working, 0, 0, data, size);
+-	  mvwinnstr(field->working, 0, 0, result, (int)need + 1);
++	  mvwinnstr(field->working, 0, 0, result, (int)need);
+ 	}
+ #else
+       result = Address_Of_Nth_Buffer(field, buffer);
diff --git a/ncurses.spec b/ncurses.spec
index 1e6bb76..c6a6566 100644
--- a/ncurses.spec
+++ b/ncurses.spec
@@ -1,7 +1,7 @@
 Summary: A terminal handling library
 Name: ncurses
 Version: 5.6
-Release: 10.20070812%{?dist}
+Release: 11.20070812%{?dist}
 License: MIT
 Group: System Environment/Libraries
 URL: http://invisible-island.net/ncurses/ncurses.html
@@ -16,6 +16,7 @@ Patch10: ncurses-5.5-20061209-xterm.patch
 Patch11: ncurses-5.6-20070120-urxvt.patch
 Patch12: ncurses-5.6-20070812-comphash.patch
 Patch13: ncurses-5.6-20070812-pad.patch
+Patch14: ncurses-5.6-20070812-fieldbuf.patch
 BuildRequires: gpm-devel
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -59,6 +60,7 @@ rm -rf tack
 %patch11 -p1 -b .urxvt
 %patch12 -p1 -b .comphash
 %patch13 -p1 -b .pad
+%patch14 -p1 -b .fieldbuf
 
 # this will be in documentation, drop executable bits
 chmod 644 test/*
@@ -188,6 +190,9 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/terminfo
 rm -rf ${RPM_BUILD_ROOT}
 
 %changelog
+* Wed Oct 10 2007 Miroslav Lichvar <mlichvar@redhat.com> 5.6-11.20070812
+- don't write beyond field buffer in form driver (#310071)
+
 * Thu Oct 04 2007 Miroslav Lichvar <mlichvar@redhat.com> 5.6-10.20070812
 - fix comp_hash string output
 - avoid comparing padding in cchar_t structure