src/patches/squid-3.4-13232.patch

   1 ------------------------------------------------------------
   2 revno: 13232
   3 revision-id: squid3@treenet.co.nz-20160330141410-t6p2dhzr8ri36fap
   4 parent: squid3@treenet.co.nz-20160220150859-3unryicod1rcx9rm
   5 author: Yuriy M. Kaminskiy <yumkam@gmail.com>
   6 committer: Amos Jeffries <squid3@treenet.co.nz>
   7 branch nick: 3.4
   8 timestamp: Thu 2016-03-31 03:14:10 +1300
   9 message:
  10   pinger: Fix buffer overflow in Icmp6::Recv
  11 ------------------------------------------------------------
  12 # Bazaar merge directive format 2 (Bazaar 0.90)
  13 # revision_id: squid3@treenet.co.nz-20160330141410-t6p2dhzr8ri36fap
  14 # target_branch: http://bzr.squid-cache.org/bzr/squid3/3.4
  15 # testament_sha1: e404755509c03ec58c0c293552a7f2a579810fd3
  16 # timestamp: 2016-03-30 14:51:02 +0000
  17 # source_branch: http://bzr.squid-cache.org/bzr/squid3/3.4
  18 # base_revision_id: squid3@treenet.co.nz-20160220150859-\
  19 #   3unryicod1rcx9rm
  20 #
  21 # Begin patch
  22 === modified file 'src/icmp/Icmp6.cc'
  23 --- src/icmp/Icmp6.cc   2014-09-15 05:06:14 +0000
  24 +++ src/icmp/Icmp6.cc   2016-03-30 14:14:10 +0000
  25 @@ -277,7 +277,7 @@
  26      #define ip6_hops   // HOPS!!!  (can it be true??)
  27
  28          ip = (struct ip6_hdr *) pkt;
  29 -        pkt += sizeof(ip6_hdr);
  30 +        NP: echo size needs to +sizeof(ip6_hdr);
  31
  32      debugs(42, DBG_CRITICAL, HERE << "ip6_nxt=" << ip->ip6_nxt <<
  33                 ", ip6_plen=" << ip->ip6_plen <<
  34 @@ -288,7 +288,6 @@
  35      */
  36
  37      icmp6header = (struct icmp6_hdr *) pkt;
  38 -    pkt += sizeof(icmp6_hdr);
  39
  40      if (icmp6header->icmp6_type != ICMP6_ECHO_REPLY) {
  41
  42 @@ -313,7 +312,7 @@
  43          return;
  44      }
  45
  46 -    echo = (icmpEchoData *) pkt;
  47 +    echo = (icmpEchoData *) (pkt + sizeof(icmp6_hdr));
  48
  49      preply.opcode = echo->opcode;
  50
  51