Blame SOURCES/dhcp-4.2.5-rh1355827.patch

fad460
--- dhcp-4.2.5.orig/server/mdb.c	2016-05-03 12:46:04.933000000 -0400
fad460
+++ dhcp-4.2.5/server/mdb.c	2016-05-18 14:38:27.553000000 -0400
fad460
@@ -720,8 +720,9 @@ void new_address_range (cfile, low, high
fad460
 {
fad460
 #if defined(COMPACT_LEASES)
fad460
 	struct lease *address_range;
fad460
+	unsigned s;
fad460
 #endif
fad460
-	unsigned min, max, i;
fad460
+	unsigned min, max, i, num_addrs;
fad460
 	char lowbuf [16], highbuf [16], netbuf [16];
fad460
 	struct shared_network *share = subnet -> shared_network;
fad460
 	struct lease *lt = (struct lease *)0;
fad460
@@ -777,9 +778,29 @@ void new_address_range (cfile, low, high
fad460
 		min = host_addr (high, subnet -> netmask);
fad460
 	}
fad460
 
fad460
+	/* get the number of addresses we want, and add it to the pool info
fad460
+	* this value is only for use when setting up lease chains and will
fad460
+	* be overwritten when expire_all_pools is run
fad460
+	*/
fad460
+	num_addrs = max - min + 1;
fad460
+
fad460
 	/* Get a lease structure for each address in the range. */
fad460
 #if defined (COMPACT_LEASES)
fad460
-	address_range = new_leases (max - min + 1, MDL);
fad460
+	s = (num_addrs + 1) * sizeof (struct lease);
fad460
+	 /* Check unsigned overflow in new_leases().
fad460
+	    With 304 byte lease structure (x86_64), this happens at
fad460
+	    range 10.0.0.0 10.215.148.52; */
fad460
+	if (((s % sizeof (struct lease)) != 0) ||
fad460
+	    ((s / sizeof (struct lease)) != (num_addrs + 1))) {
fad460
+		strcpy (lowbuf, piaddr (low));
fad460
+		strcpy (highbuf, piaddr (high));
fad460
+		parse_warn (cfile, "%s-%s is an overly large address range.",
fad460
+			   lowbuf, highbuf);
fad460
+		log_info ("Consider breaking large address ranges into multiple scopes of less than 14 million IPs each.");
fad460
+		log_info ("For more information, please visit:  https://support.roguewave.com/resources/blogs/openlogic-blogs/how-to-extend-isc-dhcp/");
fad460
+		log_fatal ("Memory overflow.");
fad460
+	}
fad460
+	address_range = new_leases (num_addrs, MDL);
fad460
 	if (!address_range) {
fad460
 		strcpy (lowbuf, piaddr (low));
fad460
 		strcpy (highbuf, piaddr (high));