mirrors/libmicrohttpd
2
0
Fork 0
mirror of https://git.gnunet.org/libmicrohttpd.git synced 2026-09-25 04:09:31 +03:00
Code Issues Packages Projects Releases Wiki Activity

gen_auth: detect invalid Digest parameters without value the end of the string

Browse Source
This commit is contained in:
Evgeny Grin (Karlson2k)
2022-06-05 12:48:31 +03:00
parent b00a58cfa7
commit 6dea1cf68e
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/microhttpd/gen_auth.c
+8 -3
View File
@@ -176,17 +176,22 @@ parse_dauth_params (const char *str,
for (p = 0; p < sizeof(map) / sizeof(map[0]); p++)
{
struct dauth_token_param *const aparam = map + p;
if ( (aparam->tk_name->len < left) &&
if ( (aparam->tk_name->len <= left) &&
MHD_str_equal_caseless_bin_n_ (str + i, aparam->tk_name->str,
aparam->tk_name->len) &&
(('=' == str[i + aparam->tk_name->len]) ||
((aparam->tk_name->len == left) ||
('=' == str[i + aparam->tk_name->len]) ||
(' ' == str[i + aparam->tk_name->len]) ||
('\t' == str[i + aparam->tk_name->len])) )
('\t' == str[i + aparam->tk_name->len]) ||
(',' == str[i + aparam->tk_name->len])) )
{
size_t value_start;
size_t value_len;
bool quoted; /* Only mark as "quoted" if backslash-escape used */
if (aparam->tk_name->len == left)
return false; /* No equal sign after parameter name, broken data */
quoted = false;
i += aparam->tk_name->len;
/* Skip all whitespaces before '=' */