Blame SOURCES/dhcp-4.2.5-rh1355827.patch

8377c7
--- dhcp-4.2.5.orig/server/mdb.c	2016-05-03 12:46:04.933000000 -0400
8377c7
+++ dhcp-4.2.5/server/mdb.c	2016-05-18 14:38:27.553000000 -0400
8377c7
@@ -720,8 +720,9 @@ void new_address_range (cfile, low, high
8377c7
 {
8377c7
 #if defined(COMPACT_LEASES)
8377c7
 	struct lease *address_range;
8377c7
+	unsigned s;
8377c7
 #endif
8377c7
-	unsigned min, max, i;
8377c7
+	unsigned min, max, i, num_addrs;
8377c7
 	char lowbuf [16], highbuf [16], netbuf [16];
8377c7
 	struct shared_network *share = subnet -> shared_network;
8377c7
 	struct lease *lt = (struct lease *)0;
8377c7
@@ -777,9 +778,29 @@ void new_address_range (cfile, low, high
8377c7
 		min = host_addr (high, subnet -> netmask);
8377c7
 	}
8377c7
 
8377c7
+	/* get the number of addresses we want, and add it to the pool info
8377c7
+	* this value is only for use when setting up lease chains and will
8377c7
+	* be overwritten when expire_all_pools is run
8377c7
+	*/
8377c7
+	num_addrs = max - min + 1;
8377c7
+
8377c7
 	/* Get a lease structure for each address in the range. */
8377c7
 #if defined (COMPACT_LEASES)
8377c7
-	address_range = new_leases (max - min + 1, MDL);
8377c7
+	s = (num_addrs + 1) * sizeof (struct lease);
8377c7
+	 /* Check unsigned overflow in new_leases().
8377c7
+	    With 304 byte lease structure (x86_64), this happens at
8377c7
+	    range 10.0.0.0 10.215.148.52; */
8377c7
+	if (((s % sizeof (struct lease)) != 0) ||
8377c7
+	    ((s / sizeof (struct lease)) != (num_addrs + 1))) {
8377c7
+		strcpy (lowbuf, piaddr (low));
8377c7
+		strcpy (highbuf, piaddr (high));
8377c7
+		parse_warn (cfile, "%s-%s is an overly large address range.",
8377c7
+			   lowbuf, highbuf);
8377c7
+		log_info ("Consider breaking large address ranges into multiple scopes of less than 14 million IPs each.");
8377c7
+		log_info ("For more information, please visit:  https://support.roguewave.com/resources/blogs/openlogic-blogs/how-to-extend-isc-dhcp/");
8377c7
+		log_fatal ("Memory overflow.");
8377c7
+	}
8377c7
+	address_range = new_leases (num_addrs, MDL);
8377c7
 	if (!address_range) {
8377c7
 		strcpy (lowbuf, piaddr (low));
8377c7
 		strcpy (highbuf, piaddr (high));