[rpms/varnish] f44: Patch for VSV00020, CVE pending

[rpms/varnish] f44: Patch for VSV00020, CVE pending

[Ingvar Hagelund]

A new commit has been pushed.

Repo   : rpms/varnish
Branch : f44
Commit : 7d7ed35536f8034e4de739817ae9824c7d702d49
Author : Ingvar Hagelund <ingvar@redpill-linpro.com>
Date   : 2026-09-21T17:29:35+02:00
Stats  : +55/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/varnish/c/7d7ed35536f8034e4de739817ae9824c7d702d49?branch=f44

Log:
Patch for VSV00020, CVE pending

---
diff --git a/varnish.spec b/varnish.spec
index 6d56a92..e54540f 100644
--- a/varnish.spec
+++ b/varnish.spec
@@ -32,7 +32,7 @@
 Summary: High-performance HTTP accelerator
 Name: varnish
 Version: 8.0.2
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: BSD-2-Clause AND (BSD-2-Clause-FreeBSD AND BSD-3-Clause AND LicenseRef-Fedora-Public-Domain AND Zlib)
 URL: https://www.varnish-cache.org/
 Source0: http://varnish-cache.org/_downloads/%{name}-%{version}.tgz
@@ -45,6 +45,9 @@ Source4: varnish.tmpfiles
 # https://github.com/varnishcache/varnish-cache/issues/4298
 Patch0:   varnish-7.7.0_fix_4298.patch
 
+# Fix for VSV00020, based on patch from upstream
+Patch1:   vsv00020.patch
+
 %if %{with bundled_jemalloc}
 # bundled jemalloc patch
 Patch100: jemalloc-5.3.0_fno-builtin.patch
@@ -154,6 +157,7 @@ Documentation files for %name
 %prep
 %setup -q
 #patch 0 -p1
+%patch 1 -p1
 tar xzf %SOURCE1
 ln -s pkg-varnish-cache-%{commit1}/redhat redhat
 ln -s pkg-varnish-cache-%{commit1}/debian debian
@@ -417,6 +421,9 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 
 
 %changelog
+* Mon Sep 21 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 8.0.2-2
+- Patch for VSV00020, CVE pending
+
 * Tue May 26 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 8.0.2-1
 - New upstream release: A security release
 - Includes fix for VSV00019 aka CVE-2026-50052

diff --git a/vsv00020.patch b/vsv00020.patch
new file mode 100644
index 0000000..7c10c4e
--- /dev/null
+++ b/vsv00020.patch
@@ -0,0 +1,47 @@
+Based on vinyl cache commit 90f5bacc14b2404e6cc349ba015f0f73b8515136
+Author: Walid Boudebouda <walid.boudebouda@gmail.com>
+Date: Mon, 6 Jul 2026 09:41:16 +0200
+
+    cache_vrt: Polish VRT_UpperLowerStrands()
+
+diff -u a/bin/varnishd/cache/cache_vrt.c b/bin/varnishd/cache/cache_vrt.c
+--- varnish-8.0.2_a/bin/varnishd/cache/cache_vrt.c	2026-09-21 16:33:56.800577349 +0200
++++ varnish-8.0.2/bin/varnishd/cache/cache_vrt.c	2026-09-21 16:34:26.243006420 +0200
+@@ -511,7 +511,7 @@
+ 	unsigned u;
+ 	char *b, *e, *r;
+ 	const char *p, *q = NULL;
+-	int i, copy = 0;
++	int i, copy = 0, op = 0;
+ 
+ 	CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
+ 	CHECK_OBJ_NOTNULL(ctx->ws, WS_MAGIC);
+@@ -525,15 +525,20 @@
+ 		if (q != NULL)
+ 			copy = 1;
+ 		for(p = q = s->p[i]; *p != '\0'; p++) {
+-			if ((up && vct_islower(*p)) ||
+-			    (!up && vct_isupper(*p))) {
+-				*b++ = *p ^ 0x20;
++			op = up ? vct_islower(*p) : vct_isupper(*p);
++
++			if (op)
+ 				copy = 1;
+-			} else if (b < e) {
+-				*b++ = *p;
+-			}
+-			if (copy && b == e)
++
++			if (!copy && b == e)
++				continue;
++			else if (b == e)
+ 				break;
++
++			if (op)
++				*b++ = *p ^ 0x20;
++			else
++				*b++ = *p;
+ 		}
+ 		if (copy && b == e) {
+ 			WS_Release(ctx->ws, 0);
+