Description: fix same-origin bypass and cache-poisoning attack via
 crafted HTTP host header
Origin: upstream, http://www.squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12698.patch
Origin: upstream, http://bazaar.launchpad.net/~squid/squid/3.3/revision/12700
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823968

Index: squid3-3.3.8/src/mime_header.cc
===================================================================
--- squid3-3.3.8.orig/src/mime_header.cc	2013-07-13 09:25:14.000000000 -0400
+++ squid3-3.3.8/src/mime_header.cc	2016-06-07 10:01:20.330765637 -0400
@@ -58,11 +58,11 @@
 
     debugs(25, 5, "mime_get_header: looking for '" << name << "'");
 
-    for (p = mime; *p; p += strcspn(p, "\n\r")) {
-        if (strcmp(p, "\r\n\r\n") == 0 || strcmp(p, "\n\n") == 0)
+    for (p = mime; *p; p += strcspn(p, "\n")) {
+        if (strcmp(p, "\n\r\n") == 0 || strcmp(p, "\n\n") == 0)
             return NULL;
 
-        while (xisspace(*p))
+        if (*p == '\n')
             ++p;
 
         if (strncasecmp(p, name, namelen))
