[libmicrohttpd] branch master updated (4520ac2d -> dbb1222d)

[gnunet]

This is an automated email from the git hooks/post-receive script.

karlson2k pushed a change to branch master
in repository libmicrohttpd.

    from 4520ac2d test_auth_parse: added new test
     new b00a58cf gen_auth: treat empty header as invalid
     new 6dea1cf6 gen_auth: detect invalid Digest parameters without value the 
end of the string
     new 3fcec14c gen_auth: added detection of incorrect delimiters in token68
     new 8a2da6d6 gen_auth: do not allow the equal sign alone for digest auth
     new dbb1222d gen_auth: do not allow semicolon for diget auth unless it is 
in a quoted string

The 5 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 src/microhttpd/gen_auth.c | 42 ++++++++++++++++++++++++++++++++++++------
 1 file changed, 36 insertions(+), 6 deletions(-)

diff --git a/src/microhttpd/gen_auth.c b/src/microhttpd/gen_auth.c
index d5353863..e13d5578 100644
--- a/src/microhttpd/gen_auth.c
+++ b/src/microhttpd/gen_auth.c
@@ -73,8 +73,10 @@ parse_bauth_params (const char *str,
     /* Find end of the token. Token cannot contain whitespace. */
     while (i < str_len && ' ' != str[i] && '\t' != str[i])
     {
-      if (0 == str[0])
-        return false; /* Binary zero is not allowed */
+      if (0 == str[i])
+        return false;  /* Binary zero is not allowed */
+      if ((',' == str[i]) || (';' == str[i]))
+        return false;  /* Only single token68 is allowed */
       i++;
     }
     token68_len = i - token68_start;
@@ -173,20 +175,28 @@ parse_dauth_params (const char *str,
     mhd_assert ('\t' != str[i]);
 
     left = str_len - i;
+    if ('=' == str[i])
+      return false; /* The equal sign is not allowed as the first character */
     for (p = 0; p < sizeof(map) / sizeof(map[0]); p++)
     {
       struct dauth_token_param *const aparam = map + p;
-      if ( (aparam->tk_name->len < left) &&
+      if ( (aparam->tk_name->len <= left) &&
            MHD_str_equal_caseless_bin_n_ (str + i, aparam->tk_name->str,
                                           aparam->tk_name->len) &&
-           (('=' == str[i + aparam->tk_name->len]) ||
+           ((aparam->tk_name->len == left) ||
+            ('=' == str[i + aparam->tk_name->len]) ||
             (' ' == str[i + aparam->tk_name->len]) ||
-            ('\t' == str[i + aparam->tk_name->len])) )
+            ('\t' == str[i + aparam->tk_name->len]) ||
+            (',' == str[i + aparam->tk_name->len]) ||
+            (';' == str[i + aparam->tk_name->len])) )
       {
         size_t value_start;
         size_t value_len;
         bool quoted; /* Only mark as "quoted" if backslash-escape used */
 
+        if (aparam->tk_name->len == left)
+          return false; /* No equal sign after parameter name, broken data */
+
         quoted = false;
         i += aparam->tk_name->len;
         /* Skip all whitespaces before '=' */
@@ -227,6 +237,8 @@ parse_dauth_params (const char *str,
           {
             if (0 == str[i])
               return false;  /* Binary zero in parameter value */
+            if (';' == str[i])
+              return false;  /* Semicolon in parameter value */
             i++;
           }
           value_len = i - value_start;
@@ -254,13 +266,17 @@ parse_dauth_params (const char *str,
       /* No matching parameter name */
       while (str_len > i && ',' != str[i])
       {
+        if ((0 == str[i]) || (';' == str[i]))
+          return false; /* Not allowed characters */
         if ('"' == str[i])
         { /* Skip quoted part */
           i++; /* Advance after the opening quote */
           while (str_len > i && '"' != str[i])
           {
+            if (0 == str[i])
+              return false;  /* Binary zero is not allowed */
             if ('\\' == str[i])
-              i++; /* Skip escaped char */
+              i++;           /* Skip escaped char */
             i++;
           }
           if (str_len <= i)
@@ -371,6 +387,20 @@ parse_auth_rq_header_ (struct MHD_Connection *c)
   h += i;
   h_len -= i;
 
+  if (0 == h_len)
+  { /* The header is an empty string */
+    rq_auth = (struct MHD_AuthRqHeader *)
+              MHD_connection_alloc_memory_ (c,
+                                            sizeof (struct MHD_AuthRqHeader));
+    c->rq_auth = rq_auth;
+    if (NULL != rq_auth)
+    {
+      memset (rq_auth, 0, sizeof(struct MHD_AuthRqHeader));
+      rq_auth->auth_type = MHD_AUTHTYPE_INVALID;
+    }
+    return false;
+  }
+
 #ifdef DAUTH_SUPPORT
   if (1)
   {

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.