Your message dated Mon, 18 Feb 2019 17:20:01 +0000
with message-id <[email protected]>
and subject line Bug#702667: fixed in ffproxy 1.6-12
has caused the Debian Bug report #702667,
regarding ffproxy: incorrect bounds check when reading headers
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
702667: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702667
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: ffproxy
Version: 1.6-10
Severity: normal
ffproxy uses bounds checks along the lines of 'i < sizeof(r->header) - 1'
in several places to bounds-check the array index variable 'i', but
r->header is an array of char* variables, so this is incorrect.
The result is that if the remote side (or the local side, probably?)
provides too many headers, then the stack is overwritten with heap
pointers to the headers in question (since 'r' is on the stack).
The trivial fix would be to replace the 6 uses of sizeof(r->header)
with 32, which is the size of the r->header array (see req.h).
- Alyssa
--- End Message ---
--- Begin Message ---
Source: ffproxy
Source-Version: 1.6-12
We believe that the bug you reported is fixed in the latest version of
ffproxy, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Bouthenot <[email protected]> (supplier of updated ffproxy package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 18 Feb 2019 03:00:24 +0000
Source: ffproxy
Binary: ffproxy ffproxy-dbgsym
Architecture: source amd64
Version: 1.6-12
Distribution: unstable
Urgency: medium
Maintainer: Emmanuel Bouthenot <[email protected]>
Changed-By: Emmanuel Bouthenot <[email protected]>
Description:
ffproxy - Light and customizable http(s) proxy server with ipv6 support
Closes: 688462 702667
Changes:
ffproxy (1.6-12) unstable; urgency=medium
.
* Update Vcs-Git and Vcs-Browser with new repository on salsa.debian.org
* Bump Standards-Version to 4.3.0
* Switch debhelper compatibility to 12
* Fix minor issues in debian/copyright
* Update manpage patch to fix more spelling errors
* Add debian/upstream/metadata
* Add a patch to fix incorrect bounds check when reading request headers
(Closes: #702667)
* Add a patch to fix conflicting declarations of some variables
(Closes: #688462)
Checksums-Sha1:
0a0e40651f6687c2691998c3458fef9cd29167e7 1795 ffproxy_1.6-12.dsc
cb0745bae324b30783d666146ebd166a5dafc4a5 13480 ffproxy_1.6-12.debian.tar.xz
f54b7145102b3a44f87717f4a10f14116e5ec552 39160 ffproxy-dbgsym_1.6-12_amd64.deb
c6d1f86e095fadcb6365907b8dffd158f9be3ae0 5674 ffproxy_1.6-12_amd64.buildinfo
4f451404e438ec493f90cf903810cf058c1fbfdd 38884 ffproxy_1.6-12_amd64.deb
Checksums-Sha256:
5b26a1bd8f00b84711466f81f87050a46a61c267f37c71ad0044672d6d316a3d 1795
ffproxy_1.6-12.dsc
32f528a38ed74156b735ae2c29da9a03abe9a04b169fd5144587f8e8ade472a7 13480
ffproxy_1.6-12.debian.tar.xz
20d23bc23f2ea22962773cd790f17137242041394960ba11679e598b2f224107 39160
ffproxy-dbgsym_1.6-12_amd64.deb
4100c299fd8c7ea0a1078e0d20fa53798706fa26a98bc314594469e6bf5f1b71 5674
ffproxy_1.6-12_amd64.buildinfo
5fb4234a024d7ed127a0c09f7c03d021f7d2d84ea55a7ad85184c3f94946d038 38884
ffproxy_1.6-12_amd64.deb
Files:
9c36fd6014bb1b35fdbcc823c58a83c1 1795 net optional ffproxy_1.6-12.dsc
c58d6b469d164f6f46b325602678e71c 13480 net optional
ffproxy_1.6-12.debian.tar.xz
c503694373136e0c73fb18c23b07746d 39160 debug optional
ffproxy-dbgsym_1.6-12_amd64.deb
b3f09b18090afdb027475fb32c349c4f 5674 net optional
ffproxy_1.6-12_amd64.buildinfo
a99079a193561249fdeec80201f948be 38884 net optional ffproxy_1.6-12_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEETQ1Tfow3vJnf8QuHSwd3I5KdQsMFAlxq5hMACgkQSwd3I5Kd
QsOJ+w//aAdwbU6qK6137F5xVjJ8B+yUMio+f66A0qgySJxMIBhJE2899UDR43+q
zsXUQS+ceR+iAfEdL4kKhCKD9mXCSIVOCxld0imYT/eDXri3eLmfdnYm9hZEMXJ2
LhDfhC9WdyRV3cv6QBmPM2fQRZ59JypnYxFXZsRRUOp4gX8WVGWUA596mp7YpyO5
Kw6KEMAd5nLLmais3DJ64bB6ZCjAs5yMNN5Dk8JgeZwQAUzIrIezuXPKAm/SAkAD
cDlDsg68uHG+wT3CkmnshPSsadIEZ2fKi+kmumdSzl+h22lpWwdCVk73MFLQKCJF
BgQq4Bj32dy3EW7w8yvxs0PaJGo2UmX1oMt68/QLJBH9eH6eWX+Qs5Wh8v0ZkG0R
uruy6cPHFEvaPLccOoJCUwdT3usT6/YMtlrr1LX0h4pLoaDJHwnWR06V9SUXmHEX
tTPx0+t4cS+5PSaXfBxT0unjh3NppaWoMN8QXtduJC6BDmv7hjKykaoIxn2219WP
pez3Iq84M90jnxkD4Ru6NCHvr/25FMVtfIgVyNpUA6vBE8EwOXgyFiOLyhPpijO4
csnlqXd0vcg3RfRuwmAIbxbUQgRCW9kO+ah8mN46ugFj8z0P/vrH2SNgRLUIDwuO
ymLMsep3g2ri/uV4NlEmI9enqIsslqFquFoh69ERCkaX8AalQm4=
=4k+d
-----END PGP SIGNATURE-----
--- End Message ---
