Blame SOURCES/squid-4.11-CVE-2020-24606.patch

88e69d
commit b789e719affbb0a6ff9c22095f6ca8db6a5f4926
88e69d
Author: Eduard Bagdasaryan <eduard.bagdasaryan@measurement-factory.com>
88e69d
Date:   2020-07-27 15:28:31 +0000
88e69d
88e69d
    Fix livelocking in peerDigestHandleReply (#698)
88e69d
    
88e69d
    peerDigestHandleReply() was missing a premature EOF check. The existing
88e69d
    peerDigestFetchedEnough() cannot detect EOF because it does not have
88e69d
    access to receivedData.length used to indicate the EOF condition. We did
88e69d
    not adjust peerDigestFetchedEnough() because it is abused to check both
88e69d
    post-I/O state and the state after each digest processing step. The
88e69d
    latter invocations lack access to receivedData.length and should not
88e69d
    really bother with EOF anyway.
88e69d
88e69d
diff --git a/src/peer_digest.cc b/src/peer_digest.cc
88e69d
index d48340f97..265f16183 100644
88e69d
--- a/src/peer_digest.cc
88e69d
+++ b/src/peer_digest.cc
88e69d
@@ -483,6 +483,15 @@ peerDigestHandleReply(void *data, StoreIOBuffer receivedData)
88e69d
 
88e69d
     } while (cbdataReferenceValid(fetch) && prevstate != fetch->state && fetch->bufofs > 0);
88e69d
 
88e69d
+    // Check for EOF here, thus giving the parser one extra run. We could avoid this overhead by
88e69d
+    // checking at the beginning of this function. However, in this case, we would have to require
88e69d
+    // that the parser does not regard EOF as a special condition (it is true now but may change
88e69d
+    // in the future).
88e69d
+    if (!receivedData.length) { // EOF
88e69d
+        peerDigestFetchAbort(fetch, fetch->buf, "premature end of digest reply");
88e69d
+        return;
88e69d
+    }
88e69d
+
88e69d
     /* Update the copy offset */
88e69d
     fetch->offset += receivedData.length;
88e69d