[ADVISORY] SQUID-2019:7 Heap Overflow issue in URN processing
Amos Jeffries <[email protected]> Sat, 9 Nov 2019 03:47:31 +1300
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <8852d5c4-caa6-f265-3fd0-2a008a6cfcc2__16784.1346397594$1573226191$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTk6NwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxOTo3 CkRhdGU6ICAgICAgICAgICAgICAgTm92ZW1iZXIgNSwgMjAxOQpTdW1tYXJ5OiAgICAgICAgICAg IEhlYXAgT3ZlcmZsb3cgaXNzdWUKICAgICAgICAgICAgICAgICAgICBpbiBVUk4gcHJvY2Vzc2lu Zy4KQWZmZWN0ZWQgdmVyc2lvbnM6ICBTcXVpZCAzLnggLT4gMy41LjI4CiAgICAgICAgICAgICAg ICAgICAgU3F1aWQgNC54IC0+IDQuOApGaXhlZCBpbiB2ZXJzaW9uOiAgIFNxdWlkIDQuOQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18KCiAgICBodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9BZHZpc29yaWVzL1NRVUlELTIw MTlfNy50eHQKICAgIGh0dHA6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFt ZT1DVkUtMjAxOS0xMjUyNgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18KClByb2JsZW0gRGVzY3JpcHRpb246CgogRHVlIHRv IGluY29ycmVjdCBidWZmZXIgbWFuYWdlbWVudCBTcXVpZCBpcyB2dWxuZXJhYmxlIHRvIGEKIGhl YXAgb3ZlcmZsb3cgYW5kIHBvc3NpYmxlIHJlbW90ZSBjb2RlIGV4ZWN1dGlvbiBhdHRhY2sgd2hl bgogcHJvY2Vzc2luZyBVUk4uCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClNldmVyaXR5OgoKIFRoaXMgYWxsb3dzIGEg bWFsaWNpb3VzIGNsaWVudCB0byB3cml0ZSBhIHN1YnN0YW50aWFsIGFtb3VudCBvZgogYXJiaXRy YXJ5IGRhdGEgdG8gdGhlIGhlYXAuIFBvdGVudGlhbGx5IGdhaW5pbmcgYWJpbGl0eSB0bwogZXhl Y3V0ZSBhcmJpdHJhcnkgY29kZS4KCiBPbiBzeXN0ZW1zIHdpdGggbWVtb3J5IGFjY2VzcyBwcm90 ZWN0aW9ucyB0aGlzIGNhbiByZXN1bHQgaW4KIHRoZSBTcXVpZCBwcm9jZXNzIGJlaW5nIHRlcm1p bmF0ZWQgdW5leHBlY3RlZGx5LiBSZXN1bHRpbmcgaW4gYQogZGVuaWFsIG9mIHNlcnZpY2UgZm9y IGFsbCBjbGllbnRzIHVzaW5nIHRoZSBwcm94eS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKVXBkYXRlZCBQYWNrYWdl czoKCiBUaGlzIGJ1ZyBpcyBmaXhlZCBieSBTcXVpZCB2ZXJzaW9uIDQuOS4KCiBJbiBhZGRpdGlv biwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRoaXMgcHJvYmxlbSBmb3IgdGhlIHN0YWJsZQogcmVsZWFz ZXMgY2FuIGJlIGZvdW5kIGluIG91ciBwYXRjaCBhcmNoaXZlczoKClNxdWlkIDQ6CiA8aHR0cDov L3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjQvY2hhbmdlc2V0cy9zcXVpZC00LTdhYTAx ODRhNzIwZmQyMTYxOTE0NzRlMDc5ZjRmZTg3ZGU3YzRmNWEucGF0Y2g+CgogSWYgeW91IGFyZSB1 c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQgdGhlbiBwbGVhc2UgcmVmZXIKIHRv IHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxhYmlsaXR5IGluZm9ybWF0aW9uIG9uIHVwZGF0 ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZlcnNpb24gaXMg dnVsbmVyYWJsZToKCiBBbGwgU3F1aWQtMi54IGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1 aWQtMy54IHVwIHRvIGFuZCBpbmNsdWRpbmcgMy41LjI4IGFyZSB2dWxuZXJhYmxlLgoKIEFsbCBT cXVpZC00LnggdXAgdG8gYW5kIGluY2x1ZGluZyA0LjggYXJlIHZ1bG5lcmFibGUuCgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KCldvcmthcm91bmRzOgoKIERlbnkgdXJuOiBwcm90b2NvbCBVUkkgYmVpbmcgcHJveGllZCB0 byBhbGwgY2xpZW50czoKCiAgICBhY2wgVVJOIHByb3RvIFVSTgogICAgaHR0cF9hY2Nlc3MgZGVu eSBVUk4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwoKQ29udGFjdCBkZXRhaWxzIGZvciB0aGUgU3F1aWQgcHJvamVjdDoK CiBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJpbmFyeSBwYWNrYWdlZCB2 ZXJzaW9ucwogb2YgU3F1aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUg eW91ciBiaW5hcnkKIHBhY2thZ2UgdmVuZG9yLgoKIElmIHlvdXIgaW5zdGFsbCBhbmQgYnVpbGQg U3F1aWQgZnJvbSB0aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwogdGhlbiB0aGUgc3F1aWQtdXNl cnNAbGlzdHMuc3F1aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdCBpcyB5b3VyCiBwcmltYXJ5IHN1 cHBvcnQgcG9pbnQuIEZvciBzdWJzY3JpcHRpb24gZGV0YWlscyBzZWUKIDxodHRwOi8vd3d3LnNx dWlkLWNhY2hlLm9yZy9TdXBwb3J0L21haWxpbmctbGlzdHMuaHRtbD4uCgogRm9yIHJlcG9ydGlu ZyBvZiBub24tc2VjdXJpdHkgYnVncyBpbiB0aGUgbGF0ZXN0IFNUQUJMRSByZWxlYXNlCiB0aGUg c3F1aWQgYnVnemlsbGEgZGF0YWJhc2Ugc2hvdWxkIGJlIHVzZWQKIDxodHRwOi8vYnVncy5zcXVp ZC1jYWNoZS5vcmcvPi4KCiBGb3IgcmVwb3J0aW5nIG9mIHNlY3VyaXR5IHNlbnNpdGl2ZSBidWdz IHNlbmQgYW4gZW1haWwgdG8gdGhlCiBzcXVpZC1idWdzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBt YWlsaW5nIGxpc3QuIEl0J3MgYSBjbG9zZWQKIGxpc3QgKHRob3VnaCBhbnlvbmUgY2FuIHBvc3Qp IGFuZCBzZWN1cml0eSByZWxhdGVkIGJ1ZyByZXBvcnRzCiBhcmUgdHJlYXRlZCBpbiBjb25maWRl bmNlIHVudGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNy ZWRpdHM6CgogVGhpcyB2dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3ZlcmVkIGJ5IEplcmlrbyBPbmUK IDxqZXJpa28ub25lQGdteC51cz4uCgogRml4ZWQgYnkgRWR1YXJkIEJhZ2Rhc2FyeWFuIG9mIFRo ZSBNZWFzdXJlbWVudCBGYWN0b3J5LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKIDIw MTktMDUtMTQgMTQ6NTY6NDkgVVRDIEluaXRpYWwgUmVwb3J0CiAyMDE5LTA2LTA1IDE1OjUyOjE3 IFVUQyBDVkUgQXNzaWdubWVudAogMjAxOS0wOS0xNSAxNTozMjozMCBVVEMgUGF0Y2hlcyBSZWxl YXNlZApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KRU5ECl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCnNxdWlkLWFubm91bmNlIG1haWxpbmcgbGlzdApzcXVpZC1hbm5vdW5jZUBsaXN0 cy5zcXVpZC1jYWNoZS5vcmcKaHR0cDovL2xpc3RzLnNxdWlkLWNhY2hlLm9yZy9saXN0aW5mby9z cXVpZC1hbm5vdW5jZQo=