From 920563e7a080155fae3ced73d6198781e8b0ff04 Mon Sep 17 00:00:00 2001 From: Francesco Chemolli <5175948+kinkie@users.noreply.github.com> Date: Sun, 2 Jun 2024 14:41:16 +0000 Subject: [PATCH] Bug 5378: type mismatch in libTrie (#1830) TrieNode::add() incorrectly computed an offset of an internal data structure, resulting in out-of-bounds memory accesses that could cause corruption or crashes. This bug was discovered and detailed by Joshua Rogers at https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html where it was filed as "Buffer Underflow in ESI". CVE: CVE-2024-37894 Upstream-Status: Backport [https://github.com/squid-cache/squid/commit/920563e7a080155fae3ced73d6198781e8b0ff04] Signed-off-by: Peter Marko --- lib/libTrie/TrieNode.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libTrie/TrieNode.cc b/lib/libTrie/TrieNode.cc index 0f991a06d..d417e0f54 100644 --- a/lib/libTrie/TrieNode.cc +++ b/lib/libTrie/TrieNode.cc @@ -32,7 +32,7 @@ TrieNode::add(char const *aString, size_t theLength, void *privatedata, TrieChar /* We trust that privatedata and existent keys have already been checked */ if (theLength) { - int index = transform ? (*transform)(*aString): *aString; + const unsigned char index = transform ? (*transform)(*aString): *aString; if (!internal[index]) internal[index] = new TrieNode; -- 2.30.2