33 lines
1.3 KiB
Diff
33 lines
1.3 KiB
Diff
From 920563e7a080155fae3ced73d6198781e8b0ff04 Mon Sep 17 00:00:00 2001
|
|
From: Francesco Chemolli <5175948+kinkie@users.noreply.github.com>
|
|
Date: Sun, 2 Jun 2024 14:41:16 +0000
|
|
Subject: [PATCH] Bug 5378: type mismatch in libTrie (#1830)
|
|
|
|
TrieNode::add() incorrectly computed an offset of an internal data
|
|
structure, resulting in out-of-bounds memory accesses that could cause
|
|
corruption or crashes.
|
|
|
|
This bug was discovered and detailed by Joshua Rogers at
|
|
https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
|
|
where it was filed as "Buffer Underflow in ESI".
|
|
|
|
Conflict: NA
|
|
Reference: https://github.com/squid-cache/squid/commit/920563e7a080155fae3ced73d6198781e8b0ff04
|
|
---
|
|
lib/libTrie/TrieNode.cc | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/lib/libTrie/TrieNode.cc b/lib/libTrie/TrieNode.cc
|
|
index 0f991a06d3e..d417e0f5448 100644
|
|
--- a/lib/libTrie/TrieNode.cc
|
|
+++ b/lib/libTrie/TrieNode.cc
|
|
@@ -32,7 +32,7 @@ TrieNode::add(char const *aString, size_t theLength, void *privatedata, TrieChar
|
|
/* We trust that privatedata and existant keys have already been checked */
|
|
|
|
if (theLength) {
|
|
- int index = transform ? (*transform)(*aString): *aString;
|
|
+ const unsigned char index = transform ? (*transform)(*aString): *aString;
|
|
|
|
if (!internal[index])
|
|
internal[index] = new TrieNode;
|