From 300a2ab01c84de26d00c4989004de7c7b5549025 Mon Sep 17 00:00:00 2001 From: Christian Grothoff Date: Tue, 28 Jul 2026 10:59:19 +0200 Subject: [PATCH] handle empty username and empty realm provided by client gracefully --- src/microhttpd/digestauth.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c index 38f51fc4..dcd8f6d7 100644 --- a/src/microhttpd/digestauth.c +++ b/src/microhttpd/digestauth.c @@ -2684,6 +2684,9 @@ digest_auth_check_all_inner (struct MHD_Connection *connection, else if ((NULL != params->username.value.str) && (NULL != params->username_ext.value.str)) return MHD_DAUTH_WRONG_USERNAME; /* Parameters cannot be used together */ + else if ((NULL != params->username.value.str) && + (0 == params->username.value.len)) + return MHD_DAUTH_WRONG_USERNAME; /* Empty username */ else if ((NULL != params->username_ext.value.str) && (MHD_DAUTH_EXT_PARAM_MIN_LEN > params->username_ext.value.len)) return MHD_DAUTH_WRONG_USERNAME; /* Broken extended notation */ @@ -2696,6 +2699,8 @@ digest_auth_check_all_inner (struct MHD_Connection *connection, if (NULL == params->realm.value.str) return MHD_DAUTH_WRONG_REALM; + else if (0 == params->realm.value.len) + return MHD_DAUTH_WRONG_REALM; /* Empty realm */ else if (((NULL == userdigest) || params->userhash) && (_MHD_AUTH_DIGEST_MAX_PARAM_SIZE < params->realm.value.len)) return MHD_DAUTH_TOO_LARGE; /* Realm is too large and should be used in hash calculations */