squid: patch CVE-2026-50012

Pick SQUID-2026:5 patch per [1].
Also add compilation error fix per [2].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-5vmx-9x64-9284
[2] https://security-tracker.debian.org/tracker/CVE-2026-50012

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-networking/recipes-daemons/squid/files/CVE-2026-50012-01.patch

@@ -0,0 +1,34 @@
+From 19fcfe922717c8b255270c032dcde4071c003bcd Mon Sep 17 00:00:00 2001
+From: Francesco Chemolli <5175948+kinkie@users.noreply.github.com>
+Date: Sat, 30 May 2026 10:16:33 +0000
+Subject: [PATCH] Harden peerDigestSwapInMask against invalid cache digest
+ reply (#2423)
+
+A cache_digest on-the-wire size may be bigger than the
+mask_size declared in the digest itself.
+
+Ignore the digest in case this happens.
+
+CVE: CVE-2026-50012
+Upstream-Status: Backport [https://github.com/squid-cache/squid/commit/19fcfe922717c8b255270c032dcde4071c003bcd]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/peer_digest.cc | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/peer_digest.cc b/src/peer_digest.cc
+index 741090574..53dac203e 100644
+--- a/src/peer_digest.cc
++++ b/src/peer_digest.cc
+@@ -622,6 +622,11 @@ peerDigestSwapInMask(void *data, char *buf, ssize_t size)
+      * NOTENOTENOTENOTENOTE: buf doesn't point to pd->cd->mask anymore!
+      * we need to do the copy ourselves!
+      */
++    Assure(size >= 0);
++    if (fetch->mask_offset + size > static_cast<ssize_t>(pd->cd->mask_size)) {
++        finishAndDeleteFetch(fetch, "peer digest mask data too large", true);
++        return -1;
++    }
+     memcpy(pd->cd->mask + fetch->mask_offset, buf, size);
+ 
+     /* NOTE! buf points to the middle of pd->cd->mask! */

meta-networking/recipes-daemons/squid/files/CVE-2026-50012-02.patch

@@ -0,0 +1,31 @@
+From c9c9a06be6fb21f400014dcb0ec7e6d573167a5d Mon Sep 17 00:00:00 2001
+From: Francesco Chemolli <5175948+kinkie@users.noreply.github.com>
+Date: Tue, 2 Jun 2026 20:53:07 +0000
+Subject: [PATCH] Fix -Wsign-compare on arm32 (#2432)
+
+Due to ssize_t differences on 32/64 bit platforms, changes
+to peerDigestSwapInMask in commit 556b91a8a7 cause
+signedness comparison errors.
+Refactor to be safe both on 32- and 64-bit platforms
+
+CVE: CVE-2026-50012
+Upstream-Status: Backport [https://github.com/squid-cache/squid/commit/c9c9a06be6fb21f400014dcb0ec7e6d573167a5d]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/peer_digest.cc | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/peer_digest.cc b/src/peer_digest.cc
+index 53dac203e..2ad08043e 100644
+--- a/src/peer_digest.cc
++++ b/src/peer_digest.cc
+@@ -623,7 +623,8 @@ peerDigestSwapInMask(void *data, char *buf, ssize_t size)
+      * we need to do the copy ourselves!
+      */
+     Assure(size >= 0);
+-    if (fetch->mask_offset + size > static_cast<ssize_t>(pd->cd->mask_size)) {
++    Assure(pd->cd->mask_size >= fetch->mask_offset);
++    if (static_cast<size_t>(size) > pd->cd->mask_size - fetch->mask_offset) {
+         finishAndDeleteFetch(fetch, "peer digest mask data too large", true);
+         return -1;
+     }

meta-networking/recipes-daemons/squid/squid_6.14.bb

@@ -26,6 +26,8 @@ SRC_URI = "https://github.com/squid-cache/${BPN}/releases/download/SQUID_${PV_U}
            file://CVE-2026-33515.patch \
            file://CVE-2026-32748.patch \
            file://CVE-2026-47729.patch \
+           file://CVE-2026-50012-01.patch \
+           file://CVE-2026-50012-02.patch \
            "
 
 SRC_URI[sha256sum] = "9eafe06f58a199b918e79d33d8aa03afb9ae0c11d18974dca0b44c2669cab6dd"