libmicrohttpd

commit 6a3d1006b8459072bcfb2ecd62d50b695272a0b0
parent f2af9bc4740166688d849f730daeb62f0b69fb0c
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Wed,  8 Jul 2026 12:34:04 +0200

bump version to v1.0.6

Diffstat:
M
ChangeLog
 | 
13
++++++++++---
M
configure.ac
 | 
4
++--
M
src/include/microhttpd.h
 | 
2
+-
M
src/microhttpd/digestauth.c
 | 
16
++++++++++------

4 files changed, 23 insertions(+), 12 deletions(-)
diff --git a/ChangeLog b/ChangeLog
@@ -1,12 +1,19 @@
+Wed Jul  8 12:32:30 PM CEST 2026
+    Fix various minor issues, like theoretical
+    integer overflows for extreme inputs or NULL
+    dereferences if the application passes NULL
+    where it should not.
+    Releasing GNU libmicrohttpd 1.0.6. -CG
+
 Thu Apr 16 10:36:54 AM CEST 2026
-    Also ensuring other HTTP client headers that 
+    Also ensuring other HTTP client headers that
     should be unique are unique.
     Releasing GNU libmicrohttpd 1.0.5. -EG/CG
 
 Mon Apr 13 11:39:04 AM CEST 2026
     Fixed bug where additional "Content-Length" headers were
-    ignored instead of rejecting the request, fixing a 
-    (minor) header smuggling vulnerability discovered 
+    ignored instead of rejecting the request, fixing a
+    (minor) header smuggling vulnerability discovered
     by SySS GmbH.
     Releasing GNU libmicrohttpd 1.0.4. -CG
 
diff --git a/configure.ac b/configure.ac
@@ -23,7 +23,7 @@
 #
 AC_PREREQ([2.64])
 LT_PREREQ([2.4.0])
-AC_INIT([GNU libmicrohttpd],[1.0.5],[libmicrohttpd@gnu.org])
+AC_INIT([GNU libmicrohttpd],[1.0.6],[libmicrohttpd@gnu.org])
 AC_CONFIG_AUX_DIR([build-aux])
 MHD_AUX_DIR='build-aux' # Must be set to the same value as in the previous line
 AC_CONFIG_HEADERS([MHD_config.h])
@@ -31,7 +31,7 @@ AC_CONFIG_MACRO_DIR([m4])
 m4_pattern_forbid([^_?MHD_[A-Z_]+_CC_])dnl
 
 LIB_VERSION_CURRENT=74
-LIB_VERSION_REVISION=3
+LIB_VERSION_REVISION=4
 LIB_VERSION_AGE=62
 AC_SUBST([LIB_VERSION_CURRENT])
 AC_SUBST([LIB_VERSION_REVISION])
diff --git a/src/include/microhttpd.h b/src/include/microhttpd.h
@@ -101,7 +101,7 @@ MHD_C_DECLRATIONS_START_HERE_
  * they are parsed as decimal numbers.
  * Example: 0x01093001 = 1.9.30-1.
  */
-#define MHD_VERSION 0x01000500
+#define MHD_VERSION 0x01000600
 
 /* If generic headers don't work on your platform, include headers
    which define 'va_list', 'size_t', 'ssize_t', 'intptr_t', 'off_t',
diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c
@@ -2495,11 +2495,9 @@ is_param_equal_caseless (const struct MHD_RqDAuthParam *param,
                                                 str,
                                                 str_len);
   return (str_len == param->value.len) &&
-         (0 ==
-          MHD_str_equal_caseless_bin_n_ (str,
+         (MHD_str_equal_caseless_bin_n_ (str,
                                          param->value.str,
                                          str_len));
-
 }
 
 
@@ -3000,8 +2998,12 @@ digest_auth_check_all_inner (struct MHD_Connection *connection,
     digest_update_with_colon (da);
   }
   /* Update digest with H(A2) */
-  MHD_bin_to_hex (hash2_bin, digest_size, tmp1);
-  digest_update (da, (const uint8_t *) tmp1, digest_size * 2);
+  MHD_bin_to_hex (hash2_bin,
+                  digest_size,
+                  tmp1);
+  digest_update (da,
+                 (const uint8_t *) tmp1,
+                 digest_size * 2);
 
   /* H(A2) is not needed anymore, reuse the buffer.
    * Use hash2_bin for the calculated response in binary form */
@@ -3011,7 +3013,9 @@ digest_auth_check_all_inner (struct MHD_Connection *connection,
     return MHD_DAUTH_ERROR;
 #endif /* MHD_DIGEST_HAS_EXT_ERROR */
 
-  if (0 != memcmp (hash1_bin, hash2_bin, digest_size))
+  if (0 != memcmp (hash1_bin,
+                   hash2_bin,
+                   digest_size))
     return MHD_DAUTH_RESPONSE_WRONG;
 
   if (MHD_DAUTH_BIND_NONCE_NONE != daemon->dauth_bind_type)