--- dhcp-3.1.1.orig/client/dhclient.c
+++ dhcp-3.1.1/client/dhclient.c
@@ -2547,8 +2547,9 @@ void script_write_params (client, prefix
 					 (struct option_state *)0,
 					 lease -> options,
 					 &global_scope, oc, MDL)) {
-		if (data.len > 3) {
-			struct iaddr netmask, subnet, broadcast;
+		struct iaddr netmask;
+		if (data.len > 3 && data.len <= sizeof(netmask.iabuf)) {
+			struct iaddr subnet, broadcast;
 
 			memcpy (netmask.iabuf, data.data, data.len);
 			netmask.len = data.len;