system/3066: dhcpd aborts with stack overflow

>Number: 3066
>Category: system
>Synopsis: dhcpd aborts with stack overflow
>Confidential: no

-- 
Chris Kuethe, GCIA: Secure Systems Specialist - U of A CNS
office: 157 General Services Bldg.	 780.492.8135
chris.kuethe@[pyxis.cns.]ualberta.ca

Opinions expressed herein are solely the responsibility of
the author. And the author wouldn't have it any other way.

>Environment:

	
	System      : OpenBSD -current
	Architecture: OpenBSD.i386
	Machine     : i386

>Description:

	Dhcpd aborts when starting, and leaves this message in the log
	"stack overflow in function subnet_inner_than". According to a
	post on misc@ this is because propolice caught a buffer overflow
	at runtime.

>How-To-Repeat:

	my machine has 3 network interfaces - one facing the cable modem,
	one for the wireless net and one for the wired net. i use the
	following dhcpd.conf, and start dhcpd with no flags.

subnet 24.86.200.0 netmask 255.255.252.0 { }

subnet 172.25.0.0 netmask 255.255.255.0 {
        option routers 172.25.0.1;
        range 172.25.0.32 172.25.0.254;
        option domain-name-servers 24.70.95.195, 24.70.95.212, 129.128.5.233;
}

subnet 172.31.0.0 netmask 255.255.255.0 {
        option routers 172.31.0.1;
        range 172.31.0.32 172.31.0.254;
        option domain-name "mainframe.cx";
        option domain-name-servers 24.70.95.195, 24.70.95.212, 129.128.5.233;
}

>Fix:

	fix dhcpd?

>Release-Note: