Blame SOURCES/squid-4.11-CVE-2020-24606.patch

08f08e
commit b789e719affbb0a6ff9c22095f6ca8db6a5f4926
08f08e
Author: Eduard Bagdasaryan <eduard.bagdasaryan@measurement-factory.com>
08f08e
Date:   2020-07-27 15:28:31 +0000
08f08e
08f08e
    Fix livelocking in peerDigestHandleReply (#698)
08f08e
    
08f08e
    peerDigestHandleReply() was missing a premature EOF check. The existing
08f08e
    peerDigestFetchedEnough() cannot detect EOF because it does not have
08f08e
    access to receivedData.length used to indicate the EOF condition. We did
08f08e
    not adjust peerDigestFetchedEnough() because it is abused to check both
08f08e
    post-I/O state and the state after each digest processing step. The
08f08e
    latter invocations lack access to receivedData.length and should not
08f08e
    really bother with EOF anyway.
08f08e
08f08e
diff --git a/src/peer_digest.cc b/src/peer_digest.cc
08f08e
index d48340f97..265f16183 100644
08f08e
--- a/src/peer_digest.cc
08f08e
+++ b/src/peer_digest.cc
08f08e
@@ -483,6 +483,15 @@ peerDigestHandleReply(void *data, StoreIOBuffer receivedData)
08f08e
 
08f08e
     } while (cbdataReferenceValid(fetch) && prevstate != fetch->state && fetch->bufofs > 0);
08f08e
 
08f08e
+    // Check for EOF here, thus giving the parser one extra run. We could avoid this overhead by
08f08e
+    // checking at the beginning of this function. However, in this case, we would have to require
08f08e
+    // that the parser does not regard EOF as a special condition (it is true now but may change
08f08e
+    // in the future).
08f08e
+    if (!receivedData.length) { // EOF
08f08e
+        peerDigestFetchAbort(fetch, fetch->buf, "premature end of digest reply");
08f08e
+        return;
08f08e
+    }
08f08e
+
08f08e
     /* Update the copy offset */
08f08e
     fetch->offset += receivedData.length;
08f08e