[ADVISORY] SQUID-2026:5 Memory corruption in cache_digest reply handling
Amos Jeffries <[email protected]> Tue, 23 Jun 2026 17:43:15 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <37ff8e66-ec31-4d60-83a2-e3fb8cabad5b__4364.30543647788$1782193649$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgIFNxdWlkIFByb3h5IENhY2hlIFNlY3VyaXR5IFVwZGF0ZSBBZHZpc29y eSBTUVVJRC0yMDI2OjUKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpBZHZpc29yeSBJRDogICAgICAgfCBTUVVJRC0yMDI2 OjUgKENWRS0yMDI2LTUwMDEyKQpEYXRlOiAgICAgICAgICAgICAgfCAyMDI2LTA2LTE0ClN1bW1h cnk6ICAgICAgICAgICB8IE1lbW9yeSBjb3JydXB0aW9uIGluIGNhY2hlX2RpZ2VzdCByZXBseSBo YW5kbGluZwpBZmZlY3RlZCB2ZXJzaW9uczogfCBTcXVpZCAzLnggLT4gMy41LjI3CiAgICAgICAg ICAgICAgICAgICAgfCBTcXVpZCA0LnggLT4gNC4xNwogICAgICAgICAgICAgICAgICAgIHwgU3F1 aWQgNS54IC0+IDUuOQogICAgICAgICAgICAgICAgICAgIHwgU3F1aWQgNi54IC0+IDYuMTQKICAg ICAgICAgICAgICAgICAgICB8IFNxdWlkIDcueCAtPiA3LjUKRml4ZWQgaW4gdmVyc2lvbjogIHwg U3F1aWQgNy42Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlvbjoKCiAgRHVlIHRvIGFuIElt cHJvcGVyIElucHV0IFZhbGlkYXRpb24gYnVnLCBTcXVpZCBpcyB2dWxuZXJhYmxlIHRvCiAgYSBI ZWFwLWJhc2VkIEJ1ZmZlciBPdmVyZmxvdyBhdHRhY2sgYWdhaW5zdCBjYWNoZSBkaWdlc3RzLgoK X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgpTZXZlcml0eToKCiAgVGhpcyBwcm9ibGVtIGFsbG93cyBhIHRydXN0ZWQgc2Vy dmVyIHRvIHBlcmZvcm0gYSBIZWFwLWJhc2VkCiAgQnVmZmVyIE92ZXJmbG93IHdoZW4gc2VuZGlu ZyBtYWxpY2lvdXNseSBjcmFmdGVkIHJlcGxpZXMgdG8KICBjYWNoZV9kaWdlc3QgcmVxdWVzdCBt ZXNzYWdlcy4KCiAgVGhpcyBhdHRhY2sgaXMgbGltaXRlZCB0byBTcXVpZCBpbnN0YW5jZXMgdGhh dCBoYXZlIGJlZW4KICBjb21waWxlZCB3aXRoIHRoZSAtLWVuYWJsZS1jYWNoZS1kaWdlc3RzIG9w dGlvbi4KCiAgVHJ1c3RlZCBwZWVycyBhcmUgZXhwZWN0ZWQgdG8gYmUgc2VydmVycyB3aXRoaW4g dGhlIHNhbWUKICBhZG1pbmlzdHJhdGl2ZSBkb21haW4uIEFzIGNhY2hlIGRpZ2VzdHMgYXJlIGV4 Y2hhbmdlZCBvdmVyIFRDUCwKICB0aGVyZSBpcyBubyByaXNrIG9mIHNwb29maW5nLgoKX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCgpVcGRhdGVkIFBhY2thZ2VzOgoKVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lv biA3LjYKCiAgSW4gYWRkaXRpb24sIHBhdGNoZXMgYWRkcmVzc2luZyB0aGlzIHByb2JsZW0gZm9y IHRoZSBzdGFibGUKICByZWxlYXNlcyBjYW4gYmUgZm91bmQgaW4gb3VyIHBhdGNoIGFyY2hpdmVz OgoKU3F1aWQgNzoKICA8aHR0cHM6Ly9naXRodWIuY29tL3NxdWlkLWNhY2hlL3NxdWlkL2NvbW1p dC8xOWZjZmU5MjI3MTdjOGIyNTUyNzBjMDMyZGNkZTQwNzFjMDAzYmNkLnBhdGNoPgogIDxodHRw czovL2dpdGh1Yi5jb20vc3F1aWQtY2FjaGUvc3F1aWQvY29tbWl0L2M5YzlhMDZiZTZmYjIxZjQw MDAxNGRjYjBlYzdlNmQ1NzMxNjdhNWQucGF0Y2g+CgogIElmIHlvdSBhcmUgdXNpbmcgYSBwcmVw YWNrYWdlZCB2ZXJzaW9uIG9mIFNxdWlkIHRoZW4gcGxlYXNlCiAgcmVmZXIgdG8gdGhlIHBhY2th Z2UgdmVuZG9yIGZvciBhdmFpbGFiaWxpdHkgaW5mb3JtYXRpb24gb24KICB1cGRhdGVkIHBhY2th Z2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZlcnNpb24gaXMgdnVsbmVyYWJs ZToKClRoZSBmb2xsb3dpbmcgdGVzdCBjYW4gYmUgdXNlZCB0byBkZXRlcm1pbmUgYWZmZWN0ZWQg ZmVhdHVyZSB1c2U6CgogICBzcXVpZCAtdiB8IGdyZXAgLXEgJ2VuYWJsZS1jYWNoZS1kaWdlc3Rz JyAmJgogICAgc3F1aWQgLWsgcGFyc2UgMj4mMSB8IGdyZXAgLXcgY2FjaGVfcGVlciB8IGdyZXAg LXYgbm8tZGlnZXN0CgogICogQWxsIFNxdWlkIDcuNSBhbmQgb2xkZXIgd2l0aG91dCBvdXRwdXQg YXJlIG5vdCB2dWxuZXJhYmxlLgoKICAqIEFsbCBTcXVpZCA3LjUgYW5kIG9sZGVyIHdpdGggb3V0 cHV0IGFyZSB2dWxuZXJhYmxlLgoKICAqIEFsbCBTcXVpZCA3LjYgYW5kIGxhdGVyIGFyZSBub3Qg dnVsbmVyYWJsZS4KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwoKV29ya2Fyb3VuZDoKCkVpdGhlcgoKICAgQXVkaXQgeW91 ciBzcXVpZCBjb25maWd1cmF0aW9uIGFuZCBlbnN1cmUgdGhhdCBhbGwgY29uZmlndXJlZAogICBj YWNoZV9wZWVyJ3MgYXJlIHVuZGVyIHlvdXIgb3JnYW5pc2F0aW9uYWwgY29udHJvbCBhbmQgZnVs bHkKICAgdHJ1c3RlZC4gVGhpcyB3aWxsIGdyZWF0bHkgcmVkdWNlIHRoZSByaXNrLgoKb3IKCiAg IERpc2FibGUgY2FjaGUgZGlnZXN0cyBmb3IgdGhvc2UgcGVlcnMgYnkgYWRkaW5nIHRoZQogICAn bm8tZGlnZXN0JyBvcHRpb24gZm9yIGNhY2hlX3BlZXIgeW91IGRvIG5vdCBkaXJlY3RseSBjb250 cm9sLgogICBUaGlzIHdpbGwgcmVtb3ZlIHRoZSB2dWxuZXJhYmlsaXR5IGF0IGNvc3Qgb2YgaW5j cmVhc2VkCiAgIGJhbmR3aWR0aC4gVXNlIG9mIEhUQ1Agb3IgSUNQIGNhbiByZWR1Y2UgdGhhdCBj b3N0LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fCgpDb250YWN0IGRldGFpbHMgZm9yIHRoZSBTcXVpZCBwcm9qZWN0OgoK ICBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJpbmFyeSBwYWNrYWdlZCB2 ZXJzaW9ucwogIG9mIFNxdWlkOiBZb3VyIGZpcnN0IHBvaW50IG9mIGNvbnRhY3Qgc2hvdWxkIGJl IHlvdXIgYmluYXJ5CiAgcGFja2FnZSB2ZW5kb3IuCgogIElmIHlvdSBpbnN0YWxsIGFuZCBidWls ZCBTcXVpZCBmcm9tIHRoZSBvcmlnaW5hbCBTcXVpZCBzb3VyY2VzCiAgdGhlbiB0aGUgPHNxdWlk LXVzZXJzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZz4gbWFpbGluZyBsaXN0IGlzCiAgeW91ciBwcmlt YXJ5IHN1cHBvcnQgcG9pbnQuIEZvciBzdWJzY3JpcHRpb24gZGV0YWlscyBzZWUKICA8aHR0cHM6 Ly93d3cuc3F1aWQtY2FjaGUub3JnL1N1cHBvcnQvbWFpbGluZy1saXN0cy5odG1sPi4KCiAgRm9y IHJlcG9ydGluZyBvZiBub24tc2VjdXJpdHkgYnVncyBpbiB0aGUgbGF0ZXN0IFNUQUJMRSByZWxl YXNlCiAgdGhlIHNxdWlkIGJ1Z3ppbGxhIGRhdGFiYXNlIHNob3VsZCBiZSB1c2VkCiAgPGh0dHBz Oi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4KCiAgRm9yIHJlcG9ydGluZyBvZiBzZWN1cml0eSBz ZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQogIDxzcXVpZC1idWdzQGxpc3RzLnNx dWlkLWNhY2hlLm9yZz4gbWFpbGluZyBsaXN0LiBJdCdzIGEgY2xvc2VkCiAgbGlzdCAodGhvdWdo IGFueW9uZSBjYW4gcG9zdCkgYW5kIHNlY3VyaXR5IHJlbGF0ZWQgYnVnIHJlcG9ydHMKICBhcmUg dHJlYXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRoZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNo ZWQuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KCkNyZWRpdHM6CgogIFRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292 ZXJlZCBpbmRlcGVuZGVudGx5IGJ5CiAgIEh1eSBIb8OgbmcgTmd1eeG7hW4gb2YgU3VuIEFzdGVy aXNrIFZpZXRuYW0sIGFuZAogICBTYXJ0aGFrIE11bnNoaQoKICBGaXhlZCBieSBGcmFuY2VzY28g Q2hlbW9sbGkgPGtpbmtpZUBzcXVpZC1jYWNoZS5vcmc+CgpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClJldmlzaW9uIGhp c3Rvcnk6CgogIDIwMjYtMDUtMTEgSW5pdGlhbCBSZXBvcnQKICAyMDI2LTA1LTMwIDEwOjE2OjMz IFBhdGNoIHB1Ymxpc2hlZAoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCkVORApfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1aWQt YW5ub3VuY2VAbGlzdHMuc3F1aWQtY2FjaGUub3JnCmh0dHBzOi8vbGlzdHMuc3F1aWQtY2FjaGUu b3JnL2xpc3RpbmZvL3NxdWlkLWFubm91bmNlCg==