diff --git a/src/ChangeLog b/src/ChangeLog
index 6fcd4f97..076826cf 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2001-04-04  Christian Fraenkel  <christian.fraenkel@gmx.net>
+
+	* url.c (parse_uname): Would run past the end of the string if the
+	username was present, but the URL did not contain a slash, e.g.
+	http://foo:bar@myhost.
+
 2001-04-03  KOJIMA Hajime  <kjm@rins.ryukoku.ac.jp>
 
 	* http.c (http_atotm): Use %A instead of %a to match full
diff --git a/src/url.c b/src/url.c
index f91263e6..7e31e51e 100644
--- a/src/url.c
+++ b/src/url.c
@@ -622,7 +622,7 @@ parse_uname (const char *url, char **user, char **passwd)
   if (*p != '@')
     return URLOK;
   /* Else find the username and password.  */
-  for (p = q = col = url; *p != '/'; p++)
+  for (p = q = col = url; *p && *p != '/'; p++)
     {
       if (*p == ':' && !*user)
 	{