This patch is ISC's mitigation code for CVE-2016-2774 - see ISC-Bugs

#41845. It was ported from ISC DHCP 4.3.4.

--- old/RELNOTES	Wed Mar 30 18:40:08 2016

+++ new/RELNOTES	Wed Mar 30 18:40:07 2016

@@ -1,6 +1,6 @@

 	      Internet Systems Consortium DHCP Distribution

-			    Version 4.1-ESV-R7-P1

-                              01 January 2016

+			    Version 4.1-ESV-R7-S2

+                              29 March 2016

 			      Release Notes

@@ -54,10 +54,18 @@

 			Changes since 4.1-ESV-R7-P1

+! Add an option in site.h to limit the number of failover and control

+  connections the server will accept.  By default this is 200.

+  [ISC-Bugs #41845]

+  CVE: CVE-2016-2774

+

+			Changes since 4.1-ESV-R7

+

 ! Update the bounds checking when receiving a packet.

   Thanks to Sebastian Poehn from Sophos for the bug report and a suggested

   patch.

   [ISC-Bugs #41267]

+  CVE: CVE-2015-8605

 			Changes since 4.1-ESV-R6

--- old/configure	Wed Mar 30 18:40:08 2016

+++ new/configure	Wed Mar 30 18:40:08 2016

@@ -574,8 +574,8 @@

 # Identity of this package.

 PACKAGE_NAME='DHCP'

 PACKAGE_TARNAME='dhcp'

-PACKAGE_VERSION='4.1-ESV-R7-P1'

-PACKAGE_STRING='DHCP 4.1-ESV-R7-P1'

+PACKAGE_VERSION='4.1-ESV-R7'

+PACKAGE_STRING='DHCP 4.1-ESV-R7'

 PACKAGE_BUGREPORT='[email protected]'

 # Factoring default headers for most tests.

@@ -2125,7 +2125,7 @@

 # Define the identity of the package.

  PACKAGE='dhcp'

- VERSION='4.1-ESV-R7-P1'

+ VERSION='4.1-ESV-R7'

 cat >>confdefs.h <<_ACEOF

--- old/configure.ac	Wed Mar 30 18:40:08 2016

+++ new/configure.ac	Wed Mar 30 18:40:08 2016

@@ -1,4 +1,4 @@

-AC_INIT([DHCP], [4.1-ESV-R7-P1], [[email protected]])

+AC_INIT([DHCP], [4.1-ESV-R7], [[email protected]])

 # we specify "foreign" to avoid having to have the GNU mandated files,

 # like AUTHORS, COPYING, and such

--- old/includes/site.h	Wed Mar 30 18:40:10 2016

+++ new/includes/site.h	Wed Mar 30 18:40:09 2016

@@ -217,3 +217,9 @@

    require the original functionality. */

 /* #define RFC3315_PRE_ERRATA_2010_08 */

+

+/* Limit the value of a file descriptor the server will use

+   when accepting a connecting request.  This can be used to

+   limit the number of TCP connections that the server will

+   allow at one time.  A value of 0 means there is no limit.*/

+#define MAX_FD_VALUE 200

--- old/omapip/listener.c	Wed Mar 30 18:40:10 2016

+++ new/omapip/listener.c	Wed Mar 30 18:40:09 2016

@@ -3,7 +3,7 @@

    Subroutines that support the generic listener object. */

 /*

- * Copyright (c) 2012 by Internet Systems Consortium, Inc. ("ISC")

+ * Copyright (c) 2012,2014,2016 by Internet Systems Consortium, Inc. ("ISC")

  * Copyright (c) 2004,2007,2009 by Internet Systems Consortium, Inc. ("ISC")

  * Copyright (c) 1999-2003 by Internet Software Consortium

  *

@@ -232,7 +232,12 @@

 			return ISC_R_NORESOURCES;

 		return ISC_R_UNEXPECTED;

 	}

-	

+

+	if ((MAX_FD_VALUE != 0) && (socket > MAX_FD_VALUE)) {

+		close(socket);

+		return (ISC_R_NORESOURCES);

+	}

+

 #if defined (TRACING)

 	/* If we're recording a trace, remember the connection. */

 	if (trace_record ()) {