--- ./client.c.orig	2002-12-31 17:24:37.000000000 -0800
+++ ./client.c	2005-09-11 16:27:13.000000000 -0700
@@ -128,6 +128,9 @@
        	default:
 	  if ( p[1] )
 	    {
+	      if ( p + 2 + p[1] >= end ) /* fix for CAN-2005-1848 */
+		goto swend;
+
 	      if ( DhcpOptions.len[*p] == p[1] )
 	        memcpy(DhcpOptions.val[*p],p+2,p[1]);
 	      else