diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 9309d10bc..16c58566d 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,7 @@
+2004-01-20  Christopher Faylor  <cgf@redhat.com>
+
+	* sec_acl.cc (setacl): Make sure sd_ret is large enough.
+
 2004-01-19  Christopher Faylor  <cgf@redhat.com>
 
 	* sigproc.cc (sigproc_terminate): Don't close sendsig handle when
diff --git a/winsup/cygwin/sec_acl.cc b/winsup/cygwin/sec_acl.cc
index 4d0f4084b..472c20329 100644
--- a/winsup/cygwin/sec_acl.cc
+++ b/winsup/cygwin/sec_acl.cc
@@ -212,6 +212,11 @@ setacl (const char *file, int nentries, __aclent32_t *aclbufp)
       __seterrno ();
       return -1;
     }
+  if (!sd_ret.realloc (sd_size))
+    {
+      set_errno (ENOMEM);
+      return -1;
+    }
   if (!MakeSelfRelativeSD (&sd, sd_ret, &sd_size))
     {
       __seterrno ();