mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-03 06:20:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

digest: added detection of more syntax error in server headers

Browse Source 
Invalid headers should not be processed otherwise they may create
a security risk.

Closes #8912
This commit is contained in:
Evgeny Grin 2022-05-25 10:35:19 +03:00 committed by Daniel Stenberg
parent 3a6fe0c767
commit 807f440301
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 29 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
lib/vauth/digest.c
View File

@ -79,44 +79,50 @@ bool Curl_auth_digest_get_pair(const char *str, char *value, char *content,
}
for(c = DIGEST_MAX_CONTENT_LENGTH - 1; *str && c--; str++) {
switch(*str) {
case '\\':
if(starts_with_quote) {
if(!escape) {
if(!escape) {
switch(*str) {
case '\\':
if(starts_with_quote) {
/* the start of an escaped quote */
escape = TRUE;
continue;
}
}
break;
break;
case ',':
if(!starts_with_quote) {
/* This signals the end of the content if we didn't get a starting
quote and then we do "sloppy" parsing */
c = 0; /* the end */
continue;
}
break;
case ',':
if(!starts_with_quote) {
/* This signals the end of the content if we didn't get a starting
quote and then we do "sloppy" parsing */
c = 0; /* the end */
continue;
}
break;
case '\r':
case '\n':
/* end of string */
c = 0;
continue;
case '\"':
if(!escape && starts_with_quote) {
case '\r':
case '\n':
/* end of string */
if(starts_with_quote)
return FALSE; /* No closing quote */
c = 0;
continue;
case '\"':
if(starts_with_quote) {
/* end of string */
c = 0;
continue;
}
else
return FALSE;
break;
}
break;
}
escape = FALSE;
*content++ = *str;
}
if(escape)
return FALSE; /* No character after backslash */
*content = 0;
*endptr = str;