Blame SOURCES/squid-CVE-2016-4052.patch

4056b0
diff --git a/src/esi/Assign.cc b/src/esi/Assign.cc
4056b0
index eb68e84..08ce5a5 100644
4056b0
--- a/src/esi/Assign.cc
4056b0
+++ b/src/esi/Assign.cc
4056b0
@@ -41,6 +41,7 @@
4056b0
 #include "esi/Assign.h"
4056b0
 #include "esi/Context.h"
4056b0
 #include "esi/Sequence.h"
4056b0
+#include "HttpReply.h"
4056b0
 
4056b0
 ESIAssign::~ESIAssign()
4056b0
 {
4056b0
diff --git a/src/esi/Esi.cc b/src/esi/Esi.cc
4056b0
index 60c2344..ef236a9 100644
4056b0
--- a/src/esi/Esi.cc
4056b0
+++ b/src/esi/Esi.cc
4056b0
@@ -1007,7 +1006,7 @@ ESIContext::start(const char *el, const char **attr, size_t attrCount)
4056b0
     ESIElement::Pointer element;
4056b0
     int specifiedattcount = attrCount * 2;
4056b0
     char *position;
4056b0
-    assert (ellen < sizeof (localbuf)); /* prevent unexpected overruns. */
4056b0
+    Must(ellen < sizeof(localbuf)); /* prevent unexpected overruns. */
4056b0
 
4056b0
     debugs(86, 5, "ESIContext::Start: element '" << el << "' with " << specifiedattcount << " tags");
4056b0
 
4056b0
@@ -1021,15 +1020,17 @@ ESIContext::start(const char *el, const char **attr, size_t attrCount)
4056b0
         /* Spit out elements we aren't interested in */
4056b0
         localbuf[0] = '<';
4056b0
         localbuf[1] = '\0';
4056b0
-        assert (xstrncpy (&localbuf[1], el, sizeof(localbuf) - 2));
4056b0
+        xstrncpy(&localbuf[1], el, sizeof(localbuf) - 2);
4056b0
         position = localbuf + strlen (localbuf);
4056b0
 
4056b0
         for (i = 0; i < specifiedattcount && attr[i]; i += 2) {
4056b0
+            Must(static_cast<size_t>(position - localbuf) < sizeof(localbuf) - 1);
4056b0
             *position = ' ';
4056b0
             ++position;
4056b0
             /* TODO: handle thisNode gracefully */
4056b0
-            assert (xstrncpy (position, attr[i], sizeof(localbuf) + (position - localbuf)));
4056b0
+            xstrncpy(position, attr[i], sizeof(localbuf) - (position - localbuf));
4056b0
             position += strlen (position);
4056b0
+            Must(static_cast<size_t>(position - localbuf) < sizeof(localbuf) - 2);
4056b0
             *position = '=';
4056b0
             ++position;
4056b0
             *position = '\"';
4056b0
@@ -1038,18 +1039,21 @@ ESIContext::start(const char *el, const char **attr, size_t attrCount)
4056b0
             char ch;
4056b0
             while ((ch = *chPtr++) != '\0') {
4056b0
                 if (ch == '\"') {
4056b0
-                    assert( xstrncpy(position, """, sizeof(localbuf) + (position-localbuf)) );
4056b0
+                    Must(static_cast<size_t>(position - localbuf) < sizeof(localbuf) - 6);
4056b0
+                    xstrncpy(position, """, sizeof(localbuf) - (position-localbuf));
4056b0
                     position += 6;
4056b0
                 } else {
4056b0
+                    Must(static_cast<size_t>(position - localbuf) < sizeof(localbuf) - 1);
4056b0
                     *position = ch;
4056b0
                     ++position;
4056b0
                 }
4056b0
             }
4056b0
-            position += strlen (position);
4056b0
+            Must(static_cast<size_t>(position - localbuf) < sizeof(localbuf) - 1);
4056b0
             *position = '\"';
4056b0
             ++position;
4056b0
         }
4056b0
 
4056b0
+        Must(static_cast<size_t>(position - localbuf) < sizeof(localbuf) - 2);
4056b0
         *position = '>';
4056b0
         ++position;
4056b0
         *position = '\0';
4056b0
@@ -1135,11 +1139,11 @@ ESIContext::end(const char *el)
4056b0
     switch (ESIElement::IdentifyElement (el)) {
4056b0
 
4056b0
     case ESIElement::ESI_ELEMENT_NONE:
4056b0
-        assert (ellen < sizeof (localbuf)); /* prevent unexpected overruns. */
4056b0
+        Must(ellen < sizeof(localbuf) - 3); /* prevent unexpected overruns. */
4056b0
         /* Add elements we aren't interested in */
4056b0
         localbuf[0] = '<';
4056b0
         localbuf[1] = '/';
4056b0
-        assert (xstrncpy (&localbuf[2], el, sizeof(localbuf) - 3));
4056b0
+        xstrncpy(&localbuf[2], el, sizeof(localbuf) - 3);
4056b0
         position = localbuf + strlen (localbuf);
4056b0
         *position = '>';
4056b0
         ++position;