OpenVPN on Windows contains an off-by-one error in the write_dhcp_search_str() function used to build DHCP options for the Windows TUN/TAP adapter (the DHCP masquerade path). The bounds check for the temporary buffer accounted for one fewer byte per DHCP DOMAIN-SEARCH entry than is actually written, so a set of DHCP options -- which can be pushed by an OpenVPN server -- whose accumulated length lands exactly on the buffer boundary triggers a single-byte overflow of a stack temporary buffer. This issue only affects OpenVPN on Windows and was fixed in OpenVPN 2.7.7 and corresponding 2.6.x updates.