- The Option Overloading support bugfix in 3.0.2b1 introduced two new

  variables that were not initialized in the case where neither FILE nor
  SNAME were suitable for option overloading.  The result is a memset-to-zero
  stack smash under the right conditions.

diff --git a/RELNOTES b/RELNOTES
index 99200686a697bd88925dc612a77a10745c920fc1..86304ddbdf85ba38f7914a7260e0d1f84e56d571 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -43,6 +43,12 @@ Murrell at BC Tel Advanced Communications.  I'd like to express my
 thanks to all of these good people here, both for working on the code
 and for prodding me into improving it.
 
+                       Changes since 3.0.2rc2
+
+- A bug introduced in 3.0.2b1 in the DHCP Option Overloading support
+  bugfix was repaired.  This bug only surfaces in the case where neither
+  the FILE nor SNAME fields are available for overloading.
+
                        Changes since 3.0.2rc1
 
 - allocate_lease() was rewritten to repair a bug in which the server would

diff --git a/common/options.c b/common/options.c
index 8932bb6ab23d4e9d1f713ae2c116a35462359ab9..a5f5bf8fb8341fefe70c253613bb6abd4fbb145d 100644 (file)
--- a/common/options.c
+++ b/common/options.c
@@ -34,7 +34,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: options.c,v 1.85.2.23 2004/10/04 23:38:04 dhankins Exp $ Copyright (c) 2004 Internet Systems Consortium.  All rights reserved.\n";
+"$Id: options.c,v 1.85.2.24 2004/11/12 22:08:19 dhankins Exp $ Copyright (c) 2004 Internet Systems Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #define DHCP_OPTION_DATA
@@ -478,7 +478,7 @@ int cons_options (inpacket, outpacket, lease, client_state,
        int need_endopt = 0;
        int have_sso = 0;
        int ocount = 0;
-       int ofbuf1, ofbuf2;
+       int ofbuf1=0, ofbuf2=0;
 
        memset (&ds, 0, sizeof ds);