-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Synopsis: ISC dhclient subnet-mask flag stack overflow
NetBSD versions: 5.0, 4.0.1, 4.0
Thanks to: Mandriva Linux Engineering Team, Christos Zoulas
Reported in NetBSD Security Advisory: NetBSD-SA2009-010
Index: dhclient.c
diff -u dhclient.c:1.19 dhclient.c:1.20
- --- dhclient.c:1.19 Tue Feb 26 05:03:29 2008
+++ dhclient.c Tue Jun 23 19:50:50 2009
@@ -2520,6 +2520,8 @@
if (data.len > 3) {
struct iaddr netmask, subnet, broadcast;
+ if (data.len > sizeof netmask.iabuf)
+ data.len = sizeof netmask.iabuf;
memcpy (netmask.iabuf, data.data, data.len);
netmask.len = data.len;
data_string_forget (&data, MDL);
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (NetBSD)
iQIcBAEBAgAGBQJKXNX0AAoJEAZJc6xMSnBuS9YQALPoi9nFtW9ydR/Lg2iXTl62
+rIrXBeFyyP99EVk7Ecw4wGPV4N4O212vem2n9dJ2Nk8hjlQ5XCAADblNH1ZRqS8
XghCOsYaKonMivABTIrUf0r5bOp1CsEBJLv4A57JkIp7OkYaROi8MR5OAmQ7Df+Z
3w1GGngRHyAD7sNAKjvQKbmhAAO7yoV8J2t5dQbmc+7loizv7nsGAo1w0ByFj4HR
wILTW/7ikwo+vtum7SgAWN6LzxImQqJJM5OpVrJpmts51xED80MYHYaqftHp0VTZ
hnefvRU9dZM9eDJMR4KVWHxXF48g1x49QrfHmT6Kkdor28c+jlevoSeR4D/QdnlZ
JtgfKBjAYO+2IhgIJpRGw8dqYo5+kK3Sxi+zJ1Kg6HGy2Nri0899y4MVYWdebftP
MtLWm1UJCiuvLoGg5Nq0dfPeskm2WAg5xGdZxQAHCz0J56Zcstoxo8+WA2vVSRQI
rDCePLdT7HT2vdLSGaFa0PbXmONzA/SqmA62tv91rPV+kDyKGmEQMaVwYM7sclap
O6szR33h9ZROAGbLDv+jaaTDVBeWgJvqk9azWk4O6Tv7jCJDihNFhzP83BljBiC0
JsfZZ48kJq7qTOI9ZsyH8HNZomYMSnkTni2XmTVbRoAo05MVfDt3YXZ90sY8qr9I
ZPnSVth3aajO6qx48uug
=LbkJ
-----END PGP SIGNATURE-----
