[meta-networking,scarthgap] squid: patch CVE-2024-37894

From: Peter Marko <peter.marko@siemens.com>

Reference: https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../squid/files/CVE-2024-37894.patch          | 36 +++++++++++++++++++
 .../recipes-daemons/squid/squid_6.9.bb        |  1 +
 2 files changed, 37 insertions(+)
 create mode 100644 meta-networking/recipes-daemons/squid/files/CVE-2024-37894.patch

Gentle ping.

> -----Original Message-----
> From: Marko, Peter (ADV D EU SK BFS1) <Peter.Marko@siemens.com>
> Sent: Sunday, August 4, 2024 23:04
> To: openembedded-devel@lists.openembedded.org
> Cc: Marko, Peter (ADV D EU SK BFS1) <Peter.Marko@siemens.com>
> Subject: [meta-networking][scarthgap][PATCH] squid: patch CVE-2024-37894
> 
> From: Peter Marko <peter.marko@siemens.com>
> 
> Reference: https://github.com/squid-cache/squid/security/advisories/GHSA-
> wgvf-q977-9xjg
> 
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
>  .../squid/files/CVE-2024-37894.patch          | 36 +++++++++++++++++++
>  .../recipes-daemons/squid/squid_6.9.bb        |  1 +
>  2 files changed, 37 insertions(+)
>  create mode 100644 meta-networking/recipes-daemons/squid/files/CVE-2024-
> 37894.patch
> 
> diff --git a/meta-networking/recipes-daemons/squid/files/CVE-2024-
> 37894.patch b/meta-networking/recipes-daemons/squid/files/CVE-2024-
> 37894.patch
> new file mode 100644
> index 0000000000..ba12b71d6f
> --- /dev/null
> +++ b/meta-networking/recipes-daemons/squid/files/CVE-2024-37894.patch
> @@ -0,0 +1,36 @@
> +From 920563e7a080155fae3ced73d6198781e8b0ff04 Mon Sep 17 00:00:00
> 2001
> +From: Francesco Chemolli <5175948+kinkie@users.noreply.github.com>
> +Date: Sun, 2 Jun 2024 14:41:16 +0000
> +Subject: [PATCH] Bug 5378: type mismatch in libTrie (#1830)
> +
> +TrieNode::add() incorrectly computed an offset of an internal data
> +structure, resulting in out-of-bounds memory accesses that could cause
> +corruption or crashes.
> +
> +This bug was discovered and detailed by Joshua Rogers at
> +https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
> +where it was filed as "Buffer Underflow in ESI".
> +
> +CVE: CVE-2024-37894
> +Upstream-Status: Backport [https://github.com/squid-
> cache/squid/commit/920563e7a080155fae3ced73d6198781e8b0ff04]
> +Signed-off-by: Peter Marko <peter.marko@siemens.com>
> +---
> + lib/libTrie/TrieNode.cc | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/lib/libTrie/TrieNode.cc b/lib/libTrie/TrieNode.cc
> +index 0f991a06d..d417e0f54 100644
> +--- a/lib/libTrie/TrieNode.cc
> ++++ b/lib/libTrie/TrieNode.cc
> +@@ -32,7 +32,7 @@ TrieNode::add(char const *aString, size_t theLength, void
> *privatedata, TrieChar
> +     /* We trust that privatedata and existent keys have already been checked */
> +
> +     if (theLength) {
> +-        int index = transform ? (*transform)(*aString): *aString;
> ++        const unsigned char index = transform ? (*transform)(*aString): *aString;
> +
> +         if (!internal[index])
> +             internal[index] = new TrieNode;
> +--
> +2.30.2
> +
> diff --git a/meta-networking/recipes-daemons/squid/squid_6.9.bb b/meta-
> networking/recipes-daemons/squid/squid_6.9.bb
> index 33d286e122..61fc6027b3 100644
> --- a/meta-networking/recipes-daemons/squid/squid_6.9.bb
> +++ b/meta-networking/recipes-daemons/squid/squid_6.9.bb
> @@ -20,6 +20,7 @@ SRC_URI = "http://www.squid-
> cache.org/Versions/v${MAJ_VER}/${BPN}-${PV}.tar.xz \
>             file://volatiles.03_squid \
>             file://0002-squid-make-squid-conf-tests-run-on-target-device.patch \
>             file://squid.nm \
> +           file://CVE-2024-37894.patch \
>             "
> 
>  SRC_URI[sha256sum] =
> "1ad72d46e1cb556e9561214f0fb181adb87c7c47927ef69bc8acd68a03f61882"
> --
> 2.30.2