DHCP server segfaults when exceeding lease limit

name: DHCP Server segfaults  when exceeding lease limit
about: debugging DHCP server

The dhcpd server dies with segmentation fault when exceeds the lease limit in a class.

See the relevant information in this ticket :

The bug is still exists in 4.4.1.

I've patched 4.4.1 with the old code and it is working now as expected on production environments (~15k endpoints/server).

Patch:

--- isc-dhcp-4.4.1.orig/server/dhcp.c
+++ isc-dhcp-4.4.1/server/dhcp.c
@@ -2554,24 +2554,16 @@ void ack_lease (packet, lease, offer, wh
                   one, and if we do, try to do so. */
                if (lease->billing_class == NULL) {
                        char *cname = "";
-                       int bill = 0;
+                        int bill = 0;
+                        for (i = 0; i < packet->class_count; i++) {
+                                if (packet->classes[i]->lease_limit) {
+                                        bill++;
+                                        if (bill_class(lease,
+                                                       packet->classes[i]))
+                                                break;
+                                }
+                        }

-                       for (i = 0; i < packet->class_count; i++) {
-                               struct class *billclass, *subclass;
-
-                               billclass = packet->classes[i];
-                               if (billclass->lease_limit) {
-                                       bill++;
-                                       if (bill_class(lease, billclass))
-                                               break;
-
-                                       subclass = billclass->superclass;
-                                       if (subclass == NULL)

Please review my code.

I couldn't understand, what was the idea behind the new classes.

Thanks,

Peter