[libmicrohttpd] 06/19: digest_auth_check(): added check for too large realm value

[gnunet]

This is an automated email from the git hooks/post-receive script.

karlson2k pushed a commit to branch master
in repository libmicrohttpd.

commit 961635da2a9d7363528940f4fa7a0148e96e90d8
Author: Evgeny Grin (Karlson2k) <k2k@narod.ru>
AuthorDate: Thu Jul 21 18:59:06 2022 +0300

    digest_auth_check(): added check for too large realm value
---
 src/microhttpd/digestauth.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c
index a3399a65..793209f9 100644
--- a/src/microhttpd/digestauth.c
+++ b/src/microhttpd/digestauth.c
@@ -1973,6 +1973,9 @@ digest_auth_check_all_inner (struct MHD_Connection 
*connection,
 
   if (NULL == params->realm.value.str)
     return MHD_DAUTH_WRONG_HEADER;
+  else if (((NULL == digest) || params->userhash) &&
+           (_MHD_AUTH_DIGEST_MAX_PARAM_SIZE < params->realm.value.len))
+    return MHD_DAUTH_TOO_LARGE; /* Realm is too large and it will be used in 
hash calculations */
 
   if (NULL == params->nc.value.str)
     return MHD_DAUTH_WRONG_HEADER;

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.