From 3fcec14c8d2a25db33b6f7e42cf7430f07250b10 Mon Sep 17 00:00:00 2001
From: "Evgeny Grin (Karlson2k)" <k2k@narod.ru>
Date: Sat, 4 Jun 2022 16:42:49 +0300
Subject: [PATCH] gen_auth: added detection of incorrect delimiters in token68

---
 src/microhttpd/gen_auth.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/microhttpd/gen_auth.c b/src/microhttpd/gen_auth.c
index 47dbf35f..04894d9a 100644
--- a/src/microhttpd/gen_auth.c
+++ b/src/microhttpd/gen_auth.c
@@ -73,8 +73,10 @@ parse_bauth_params (const char *str,
     /* Find end of the token. Token cannot contain whitespace. */
     while (i < str_len && ' ' != str[i] && '\t' != str[i])
     {
-      if (0 == str[0])
-        return false; /* Binary zero is not allowed */
+      if (0 == str[i])
+        return false;  /* Binary zero is not allowed */
+      if ((',' == str[i]) || (';' == str[i]))
+        return false;  /* Only single token68 is allowed */
       i++;
     }
     token68_len = i - token68_start;