From e83e673076e0672a74a11d6a6e1fae6a08151ae7 Mon Sep 17 00:00:00 2001 From: Francesco Chemolli <5175948+kinkie@users.noreply.github.com> Date: Fri, 29 May 2026 16:08:42 +0000 Subject: [PATCH 1/3] Support Nettle 4.0 md5_digest API (#2424) error: no matching function for call to nettle_md5_digest Nettle v4.x md5_digest() function does not have a length parameter present in Nettle v3. --- configure.ac | 2 +- include/md5.h | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 1dc5c66320b..40a5602596f 100644 --- a/configure.ac +++ b/configure.ac @@ -1017,7 +1017,7 @@ SQUID_AUTO_LIB(nettle,[Nettle crypto],[LIBNETTLE]) SQUID_CHECK_LIB_WORKS(nettle,[ PKG_CHECK_MODULES([LIBNETTLE],[nettle >= 3.4],[ CPPFLAGS="$LIBNETTLE_CFLAGS $CPPFLAGS" - AC_CHECK_HEADERS(nettle/base64.h nettle/md5.h) + AC_CHECK_HEADERS(nettle/base64.h nettle/md5.h nettle/version.h) ],[:]) ]) diff --git a/include/md5.h b/include/md5.h index 8b52ab49385..907d40c21f8 100644 --- a/include/md5.h +++ b/include/md5.h @@ -12,11 +12,20 @@ #if HAVE_NETTLE_MD5_H #include +#if HAVE_NETTLE_VERSION_H +#include +#endif + typedef struct md5_ctx SquidMD5_CTX; #define SquidMD5Init(c) md5_init((c)) #define SquidMD5Update(c,b,l) md5_update((c), (l), (const uint8_t *)(b)) + +#if NETTLE_VERSION_MAJOR >= 4 +#define SquidMD5Final(d,c) md5_digest((c), (uint8_t *)(d)) +#else #define SquidMD5Final(d,c) md5_digest((c), MD5_DIGEST_SIZE, (uint8_t *)(d)) +#endif #define SQUID_MD5_DIGEST_LENGTH MD5_DIGEST_SIZE From 19fcfe922717c8b255270c032dcde4071c003bcd Mon Sep 17 00:00:00 2001 From: Francesco Chemolli <5175948+kinkie@users.noreply.github.com> Date: Sat, 30 May 2026 10:16:33 +0000 Subject: [PATCH 2/3] Harden peerDigestSwapInMask against invalid cache digest reply (#2423) A cache_digest on-the-wire size may be bigger than the mask_size declared in the digest itself. Ignore the digest in case this happens. --- src/peer_digest.cc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/peer_digest.cc b/src/peer_digest.cc index 741090574d6..53dac203eab 100644 --- a/src/peer_digest.cc +++ b/src/peer_digest.cc @@ -558,6 +558,11 @@ peerDigestSwapInMask(void *data, char *buf, ssize_t size) * NOTENOTENOTENOTENOTE: buf doesn't point to pd->cd->mask anymore! * we need to do the copy ourselves! */ + Assure(size >= 0); + if (fetch->mask_offset + size > static_cast(pd->cd->mask_size)) { + finishAndDeleteFetch(fetch, "peer digest mask data too large", true); + return -1; + } memcpy(pd->cd->mask + fetch->mask_offset, buf, size); /* NOTE! buf points to the middle of pd->cd->mask! */ From 0ed86a1d50614082bcd9e3a913d58aeefcbb896e Mon Sep 17 00:00:00 2001 From: Francesco Chemolli Date: Sun, 31 May 2026 15:54:32 +0000 Subject: [PATCH 3/3] v7.6 --- ChangeLog | 10 ++++++++++ configure.ac | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 1b2d12a3801..46dacc83845 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,13 @@ +Changes in squid-7.6 (31 May 2026): + + - Harden peerDigestSwapInMask against invalid cache digest reply + - Honor reply_header_max_size for received FTP control responses + - Fix parsing of legacy url_rewrite_program responses + - Improve parsing of certain FTP directory listing formats + - Fix handling of truncated legacy errorpage %codes + - Support Nettle 4.0 md5_digest API + - ... and some code and portability cleanups + Changes in squid-7.5 (12 Mar 2026): - Bug 5501: Squid may exit when ACLs decode an invalid URI diff --git a/configure.ac b/configure.ac index 40a5602596f..8dc1c18ec5a 100644 --- a/configure.ac +++ b/configure.ac @@ -5,7 +5,7 @@ ## Please see the COPYING and CONTRIBUTORS files for details. ## -AC_INIT([Squid Web Proxy],[7.5-VCS],[https://bugs.squid-cache.org/],[squid]) +AC_INIT([Squid Web Proxy],[7.6-VCS],[https://bugs.squid-cache.org/],[squid]) AC_PREREQ(2.61) AC_CONFIG_HEADERS([include/autoconf.h]) AC_CONFIG_AUX_DIR(cfgaux)