-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Synopsis: ISC dhclient subnet-mask flag stack overflow
NetBSD versions: 5.0, 4.0.1, 4.0
Thanks to: Mandriva Linux Engineering Team, Christos Zoulas
Reported in NetBSD Security Advisory: NetBSD-SA2009-010

Index: dhclient.c
diff -u dhclient.c:1.19 dhclient.c:1.20
- --- dhclient.c:1.19	Tue Feb 26 05:03:29 2008
+++ dhclient.c	Tue Jun 23 19:50:50 2009
@@ -2520,6 +2520,8 @@
 		if (data.len > 3) {
 			struct iaddr netmask, subnet, broadcast;
 
+			if (data.len > sizeof netmask.iabuf)
+			    data.len = sizeof netmask.iabuf;
 			memcpy (netmask.iabuf, data.data, data.len);
 			netmask.len = data.len;
 			data_string_forget (&data, MDL);
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (NetBSD)

iQIcBAEBAgAGBQJKXNX0AAoJEAZJc6xMSnBuS9YQALPoi9nFtW9ydR/Lg2iXTl62
+rIrXBeFyyP99EVk7Ecw4wGPV4N4O212vem2n9dJ2Nk8hjlQ5XCAADblNH1ZRqS8
XghCOsYaKonMivABTIrUf0r5bOp1CsEBJLv4A57JkIp7OkYaROi8MR5OAmQ7Df+Z
3w1GGngRHyAD7sNAKjvQKbmhAAO7yoV8J2t5dQbmc+7loizv7nsGAo1w0ByFj4HR
wILTW/7ikwo+vtum7SgAWN6LzxImQqJJM5OpVrJpmts51xED80MYHYaqftHp0VTZ
hnefvRU9dZM9eDJMR4KVWHxXF48g1x49QrfHmT6Kkdor28c+jlevoSeR4D/QdnlZ
JtgfKBjAYO+2IhgIJpRGw8dqYo5+kK3Sxi+zJ1Kg6HGy2Nri0899y4MVYWdebftP
MtLWm1UJCiuvLoGg5Nq0dfPeskm2WAg5xGdZxQAHCz0J56Zcstoxo8+WA2vVSRQI
rDCePLdT7HT2vdLSGaFa0PbXmONzA/SqmA62tv91rPV+kDyKGmEQMaVwYM7sclap
O6szR33h9ZROAGbLDv+jaaTDVBeWgJvqk9azWk4O6Tv7jCJDihNFhzP83BljBiC0
JsfZZ48kJq7qTOI9ZsyH8HNZomYMSnkTni2XmTVbRoAo05MVfDt3YXZ90sY8qr9I
ZPnSVth3aajO6qx48uug
=LbkJ
-----END PGP SIGNATURE-----