Control: tags 1148187 + patch Control: tags 1148187 + pending Dear maintainer,
I've prepared an NMU for vinyl-cache (versioned as 9.0.1-4.1) and uploaded it to DELAYED/7. Please feel free to tell me if I should cancel it. Regards. -- Regards, Aron Xu
diffstat for vinyl-cache-9.0.1 vinyl-cache-9.0.1 changelog | 8 ++++++++ patches/fix_vsv20 | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ patches/series | 1 + 3 files changed, 60 insertions(+) diff -Nru vinyl-cache-9.0.1/debian/changelog vinyl-cache-9.0.1/debian/changelog --- vinyl-cache-9.0.1/debian/changelog 2026-07-07 21:12:18.000000000 +0800 +++ vinyl-cache-9.0.1/debian/changelog 2026-10-23 13:07:48.000000000 +0800 @@ -1,3 +1,11 @@ +vinyl-cache (9.0.1-4.1) unstable; urgency=high + + * Non-maintainer upload. + * Backport the fix for the VCL .upper()/.lower() workspace overflow + (CVE-2026-93894, VSV00020). (Closes: #1148187) + + -- Aron Xu <[email protected]> Fri, 23 Oct 2026 13:07:48 +0800 + vinyl-cache (9.0.1-4) unstable; urgency=medium * Add more Varnish compatibility: diff -Nru vinyl-cache-9.0.1/debian/patches/fix_vsv20 vinyl-cache-9.0.1/debian/patches/fix_vsv20 --- vinyl-cache-9.0.1/debian/patches/fix_vsv20 1970-01-01 07:30:00.000000000 +0730 +++ vinyl-cache-9.0.1/debian/patches/fix_vsv20 2026-10-23 13:07:48.000000000 +0800 @@ -0,0 +1,51 @@ +Description: Bound case-conversion writes by the workspace reservation + Preserve the single-string no-copy optimization while checking the + reservation before writing any converted or unchanged byte. +Author: Walid Boudebouda <[email protected]> +Origin: upstream, https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/853d397f30753bce1587991fcf9193c63fb4d1eb +Bug: https://vinyl-cache.org/security/VSV00020.html +Bug-Debian: https://bugs.debian.org/1148187 +Forwarded: not-needed +Last-Update: 2026-10-23 + +diff --git a/bin/vinyld/cache/cache_vrt.c b/bin/vinyld/cache/cache_vrt.c +index 7bc2e62519..7c1168aef4 100644 +--- a/bin/vinyld/cache/cache_vrt.c ++++ b/bin/vinyld/cache/cache_vrt.c +@@ -511,7 +511,7 @@ VRT_UpperLowerStrands(VRT_CTX, VCL_STRANDS s, int up) + unsigned u; + char *b, *e, *r; + const char *p, *q = NULL; +- int i, copy = 0; ++ int i, copy = 0, op = 0; + + CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC); + CHECK_OBJ_NOTNULL(ctx->ws, WS_MAGIC); +@@ -525,15 +525,20 @@ VRT_UpperLowerStrands(VRT_CTX, VCL_STRANDS s, int up) + if (q != NULL) + copy = 1; + for(p = q = s->p[i]; *p != '\0'; p++) { +- if ((up && vct_islower(*p)) || +- (!up && vct_isupper(*p))) { +- *b++ = *p ^ 0x20; ++ op = up ? vct_islower(*p) : vct_isupper(*p); ++ ++ if (op) + copy = 1; +- } else if (b < e) { +- *b++ = *p; +- } +- if (copy && b == e) ++ ++ if (!copy && b == e) ++ continue; ++ else if (b == e) + break; ++ ++ if (op) ++ *b++ = *p ^ 0x20; ++ else ++ *b++ = *p; + } + if (copy && b == e) { + WS_Release(ctx->ws, 0); diff -Nru vinyl-cache-9.0.1/debian/patches/series vinyl-cache-9.0.1/debian/patches/series --- vinyl-cache-9.0.1/debian/patches/series 2026-07-07 08:35:29.000000000 +0800 +++ vinyl-cache-9.0.1/debian/patches/series 2026-10-23 13:07:48.000000000 +0800 @@ -3,3 +3,4 @@ varnish_compatibility fix_vcc_cc set_vcs_version +fix_vsv20
signature.asc
Description: PGP signature
