Here is the dpatch that went into 2.7.STABLE9-4.1+deb7u1. Cheers,
--Seb
#! /bin/sh -e ## 70-CVE-2014-3609.dpatch by Sebastien Delafond <[email protected]> ## Based on upstream patch for 3.0: ## http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9201.patch ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: Default error dir is under /usr/share/squid for Debian if [ $# -ne 1 ]; then echo >&2 "`basename $0`: script expects -patch|-unpatch as argument" exit 1 fi case "$1" in -patch) patch -f --no-backup-if-mismatch -p0 < $0;; -unpatch) patch -f --no-backup-if-mismatch -R -p0 < $0;; *) echo >&2 "`basename $0`: script expects -patch|-unpatch as argument" exit 1;; esac exit 0 --- src/HttpHdrRange.c 2008-04-25 21:42:54.000000000 +0200 +++ src/HttpHdrRange.c.new 2015-01-25 11:58:45.358061390 +0100 @@ -89,7 +89,7 @@ return NULL; /* is it a suffix-byte-range-spec ? */ if (*field == '-') { - if (!httpHeaderParseSize(field + 1, &spec.length)) + if (!httpHeaderParseSize(field + 1, &spec.length) || !known_spec(spec.length)) return NULL; } else /* must have a '-' somewhere in _this_ field */ @@ -97,13 +97,13 @@ debug(64, 2) ("ignoring invalid (missing '-') range-spec near: '%s'\n", field); return NULL; } else { - if (!httpHeaderParseSize(field, &spec.offset)) + if (!httpHeaderParseSize(field, &spec.offset) || !known_spec(spec.offset)) return NULL; p++; /* do we have last-pos ? */ if (p - field < flen) { squid_off_t last_pos; - if (!httpHeaderParseSize(p, &last_pos)) + if (!httpHeaderParseSize(p, &last_pos) || !known_spec(last_pos)) return NULL; spec.length = size_diff(last_pos + 1, spec.offset); }
