From 961635da2a9d7363528940f4fa7a0148e96e90d8 Mon Sep 17 00:00:00 2001 From: "Evgeny Grin (Karlson2k)" Date: Thu, 21 Jul 2022 18:59:06 +0300 Subject: [PATCH] digest_auth_check(): added check for too large realm value --- src/microhttpd/digestauth.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c index a3399a65..793209f9 100644 --- a/src/microhttpd/digestauth.c +++ b/src/microhttpd/digestauth.c @@ -1973,6 +1973,9 @@ digest_auth_check_all_inner (struct MHD_Connection *connection, if (NULL == params->realm.value.str) return MHD_DAUTH_WRONG_HEADER; + else if (((NULL == digest) || params->userhash) && + (_MHD_AUTH_DIGEST_MAX_PARAM_SIZE < params->realm.value.len)) + return MHD_DAUTH_TOO_LARGE; /* Realm is too large and it will be used in hash calculations */ if (NULL == params->nc.value.str) return MHD_DAUTH_WRONG_HEADER;