[pkgsrc/trunk]: pkgsrc/www/squid27 Add CVE-2009-2855 DoS fix from squid's rep...

[taca <taca%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/412b0bafa29d
branches:  trunk
changeset: 564928:412b0bafa29d
user:      taca <taca%pkgsrc.org@localhost>
date:      Sun Sep 13 01:00:16 2009 +0000

description:
Add CVE-2009-2855 DoS fix from squid's repositry.

Bump PKGREVISION.

diffstat:

 www/squid27/Makefile         |   4 ++--
 www/squid27/distinfo         |   3 ++-
 www/squid27/patches/patch-am |  37 +++++++++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+), 3 deletions(-)

diffs (69 lines):

diff -r d9d298d89daf -r 412b0bafa29d www/squid27/Makefile
--- a/www/squid27/Makefile      Sun Sep 13 00:13:50 2009 +0000
+++ b/www/squid27/Makefile      Sun Sep 13 01:00:16 2009 +0000
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.7 2009/07/01 02:17:46 taca Exp $
+# $NetBSD: Makefile,v 1.8 2009/09/13 01:00:16 taca Exp $
 
 DISTNAME=      squid-2.7.STABLE6
 PKGNAME=       ${DISTNAME:S/STABLE//}
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    www
 MASTER_SITES=  ${SQUID_MASTER_SITES} \
                http://www.squid-cache.org/Versions/v2/2.7/
diff -r d9d298d89daf -r 412b0bafa29d www/squid27/distinfo
--- a/www/squid27/distinfo      Sun Sep 13 00:13:50 2009 +0000
+++ b/www/squid27/distinfo      Sun Sep 13 01:00:16 2009 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.4 2009/02/05 13:43:06 taca Exp $
+$NetBSD: distinfo,v 1.5 2009/09/13 01:00:16 taca Exp $
 
 SHA1 (squid-2.7.STABLE6.tar.bz2) = b4b323be1ff3617a22070c243b2504f30d6b302d
 RMD160 (squid-2.7.STABLE6.tar.bz2) = d804175b95c6b026abed505b086eeaa2c479d2e2
@@ -15,3 +15,4 @@
 SHA1 (patch-aj) = f1d18a900d7ada0985499979398bb12dace3ee40
 SHA1 (patch-ak) = 6863cac0fe9100f4b8c3c05cb321324a4abf0a4c
 SHA1 (patch-al) = 43ff4508d964d273227263b7a623d67725e8b7bd
+SHA1 (patch-am) = 2d098a9da3ba83a340cd9552950cc02e3de47cf9
diff -r d9d298d89daf -r 412b0bafa29d www/squid27/patches/patch-am
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/www/squid27/patches/patch-am      Sun Sep 13 01:00:16 2009 +0000
@@ -0,0 +1,37 @@
+$NetBSD: patch-am,v 1.1 2009/09/13 01:00:16 taca Exp $
+
+* A patch for CVE-2009-2855 DoS fix from squid's repositry: PatchSet 12541.
+
+--- src/HttpHeaderTools.c.orig 2008-04-02 10:00:11.000000000 +0900
++++ src/HttpHeaderTools.c
+@@ -239,6 +239,10 @@ int
+ strListGetItem(const String * str, char del, const char **item, int *ilen, const char **pos)
+ {
+     size_t len;
++    /* ',' is always enabled as field delimiter as this is required for
++     * processing merged header values properly, even if Cookie normally
++     * uses ';' as delimiter.
++     */
+     static char delim[3][8] =
+     {
+       "\"?,",
+@@ -261,16 +265,15 @@ strListGetItem(const String * str, char 
+     /* find next delimiter */
+     do {
+       *pos += strcspn(*pos, delim[quoted]);
+-      if (**pos == del)
+-          break;
+       if (**pos == '"') {
+           quoted = !quoted;
+           *pos += 1;
+-      }
+-      if (quoted && **pos == '\\') {
++      } else if (quoted && **pos == '\\') {
+           *pos += 1;
+           if (**pos)
+               *pos += 1;
++      } else {
++              break;          /* Delimiter found, marking the end of this value */
+       }
+     } while (**pos);
+     len = *pos - *item;               /* *pos points to del or '\0' */