mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-03 06:20:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

digest: tolerate missing "realm"

Browse Source 
Server headers may not define "realm", avoid NULL pointer dereference
in such cases.

Closes #8912
This commit is contained in:
Evgeny Grin 2022-05-25 18:51:19 +03:00 committed by Daniel Stenberg
parent 807f440301
commit f59508e6cd
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib/vauth/digest.c
View File

@ -695,7 +695,7 @@ static CURLcode auth_create_digest_http_message(
}
if(digest->userhash) {
hashthis = aprintf("%s:%s", userp, digest->realm);
hashthis = aprintf("%s:%s", userp, digest->realm ? digest->realm : "");
if(!hashthis)
return CURLE_OUT_OF_MEMORY;
@ -715,7 +715,8 @@ static CURLcode auth_create_digest_http_message(
unq(nonce-value) ":" unq(cnonce-value)
*/
hashthis = aprintf("%s:%s:%s", userp, digest->realm, passwdp);
hashthis = aprintf("%s:%s:%s", userp, digest->realm ? digest->realm : "",
passwdp);
if(!hashthis)
return CURLE_OUT_OF_MEMORY;
@ -804,7 +805,13 @@ static CURLcode auth_create_digest_http_message(
userp_quoted = auth_digest_string_quoted(digest->userhash ? userh : userp);
if(!userp_quoted)
return CURLE_OUT_OF_MEMORY;
realm_quoted = auth_digest_string_quoted(digest->realm);
if(digest->realm)
realm_quoted = auth_digest_string_quoted(digest->realm);
else {
realm_quoted = malloc(1);
if(realm_quoted)
realm_quoted[0] = 0;
}
if(!realm_quoted) {
free(userp_quoted);
return CURLE_OUT_OF_MEMORY;