Sun Feb 14 13:27:52 2010 UTC ()

Add a security patch described security advisory SQUID-2010_2.txt,
http://www.squid-cache.org/Advisories/SQUID-2010_2.txt

Patch was the same content as official one.

http://www.squid-cache.org/Versions/v2/2.7/changesets/12600.patch.


(taca)

diff -r1.11 -r1.12 pkgsrc/www/squid27/Makefile
diff -r1.7 -r1.8 pkgsrc/www/squid27/distinfo
diff -r0 -r1.1 pkgsrc/www/squid27/patches/patch-ao

--- pkgsrc/www/squid27/Attic/Makefile 2010/02/02 14:43:57 1.11
+++ pkgsrc/www/squid27/Attic/Makefile 2010/02/14 13:27:52 1.12

 @@ -1,18 +1,18 @@
-# $NetBSD: Makefile,v 1.11 2010/02/02 14:43:57 taca Exp $
+# $NetBSD: Makefile,v 1.12 2010/02/14 13:27:52 taca Exp $
 DISTNAME=	squid-2.7.STABLE7
 PKGNAME=	${DISTNAME:S/STABLE//}
-PKGREVISION=	2
+PKGREVISION=	3
 CATEGORIES=	www
 MASTER_SITES=	${SQUID_MASTER_SITES} \
 		http://www.squid-cache.org/Versions/v2/2.7/
 EXTRACT_SUFX=	.tar.bz2
 MAINTAINER=	taca@NetBSD.org
 HOMEPAGE=	http://www.squid-cache.org/
 COMMENT=	Post-Harvest_cached WWW proxy cache and accelerator
 LICENSE=	gnu-gpl-v2
 USE_TOOLS+=		perl
 GNU_CONFIGURE=		yes
 PKG_DESTDIR_SUPPORT=	destdir

--- pkgsrc/www/squid27/Attic/distinfo 2010/02/02 14:43:57 1.7
+++ pkgsrc/www/squid27/Attic/distinfo 2010/02/14 13:27:52 1.8

 @@ -1,18 +1,19 @@
-$NetBSD: distinfo,v 1.7 2010/02/02 14:43:57 taca Exp $
+$NetBSD: distinfo,v 1.8 2010/02/14 13:27:52 taca Exp $
 SHA1 (squid-2.7.STABLE7.tar.bz2) = 0729116f309093e4f141e000136cdec39290628a
 RMD160 (squid-2.7.STABLE7.tar.bz2) = a13df321fb0831de963c77f6e33e3f374634d353
 Size (squid-2.7.STABLE7.tar.bz2) = 1341869 bytes
 SHA1 (patch-aa) = e6b112b463b1bc996490c99b91945361f0c2506a
 SHA1 (patch-ab) = 0d8e73eab50a54bd9c8662ee418c0640f30fdeea
 SHA1 (patch-ac) = 175bc741bb2adc6b5f3452c6a8d25e594e7c3acd
 SHA1 (patch-ad) = 24e7303aa3160a3e675da333737eade458c5c197
 SHA1 (patch-ae) = a78e762c1ad928eef66b12395d48bc69542e32d9
 SHA1 (patch-af) = d8bfc5e92988ffa37d39c799e62176974fb9c27a
 SHA1 (patch-ag) = b375ecb8eefb4059642450fd25a0ec8e0d74efd7
 SHA1 (patch-ah) = c1c22c57e5e63d0d0756202224d156e47413a4d8
 SHA1 (patch-ai) = a227e6fc622f1bda3fa49406b4d588c1f1f78430
 SHA1 (patch-aj) = c5c7cd10a63a5066eee63988775f71758ed5463e
 SHA1 (patch-ak) = 6863cac0fe9100f4b8c3c05cb321324a4abf0a4c
 SHA1 (patch-al) = a9e957a90dc6956e59668c297dd8566642baecff
 SHA1 (patch-an) = 9170bdd57f5428e7b64b4db2e1ffdee3c032643e
 SHA1 (patch-ao) = 5df91c372baf8d81fcb47a5e847c7ed77bed8d7a

$NetBSD: patch-ao,v 1.1 2010/02/14 13:27:52 taca Exp $

This is fix for security problem:

http://www.squid-cache.org/Advisories/SQUID-2010_2.txt

Since the announced patch contains RCS style revision string, it never
applied to clearly.

http://www.squid-cache.org/Versions/v2/2.7/changesets/12600.patch.

--- src/htcp.c.orig	2008-05-04 23:23:13.000000000 +0000
+++ src/htcp.c
@@ -950,6 +950,11 @@ htcpHandleClr(htcpDataHeader * hdr, char
 	debug(31, 3) ("htcpHandleClr: htcpUnpackSpecifier failed\n");
 	return;
     }
+    if (!s->request) {
+	debug(31, 2) ("htcpHandleTstRequest: failed to parse request\n");
+	htcpFreeSpecifier(s);
+	return;
+    }
     if (!htcpAccessCheck(Config.accessList.htcp_clr, s, from)) {
 	debug(31, 2) ("htcpHandleClr: Access denied\n");
 	htcpFreeSpecifier(s);