]> git.ipfire.org Git - thirdparty/squid.git/commit
Do not update StoreEntry expiration after errorAppendEntry() (#1580)
authorAlex Rousskov <rousskov@measurement-factory.com>
Sun, 12 Nov 2023 09:33:20 +0000 (09:33 +0000)
committerSquid Anubis <squid-anubis@squid-cache.org>
Tue, 14 Nov 2023 12:17:30 +0000 (12:17 +0000)
commit5bede3305cabb9ac19babecf3ebaf64f43f7b53e
tree4383aca607bc269d4361ad0e654d556cc61f04a4
parentb850f8b2161635fba683e9f55e8a2f068937174a
Do not update StoreEntry expiration after errorAppendEntry() (#1580)

errorAppendEntry() is responsible for setting entry expiration times,
which it does by calling StoreEntry::storeErrorResponse() that calls
StoreEntry::negativeCache().

This change was triggered by a vulnerability report by Joshua Rogers at
https://megamansec.github.io/Squid-Security-Audit/cache-uaf.html where
it was filed as "Use-After-Free in Cache Manager Errors". The reported
"use after free" vulnerability was unknowingly addressed by 2022 commit
1fa761a that removed excessively long "reentrant" store_client calls
responsible for the disappearance of the properly locked StoreEntry in
this (and probably other) contexts.
src/cache_manager.cc