libmicrohttpd

commit 8632cd8c4bb87b5f120d2a518f9ad4807b83c93c
parent 095d09c986c895f197d32a8aef67f9f42efcdebe
Author: Evgeny Grin (Karlson2k) <k2k@narod.ru>
Date:   Tue, 12 Apr 2016 14:36:14 +0000

MHD_digest_auth_check(): decode timestamp value by internal function, added error checking,
added buffer overrun checking.
digest auth now should be more secure

Diffstat:
M
src/microhttpd/digestauth.c
 | 
10
+++++++++-

1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c
@@ -619,7 +619,15 @@ MHD_digest_auth_check (struct MHD_Connection *connection,
        header value. */
     return MHD_NO;
   }
-  nonce_time = strtoul (nonce + len - TIMESTAMP_HEX_LEN, (char **)NULL, 16);
+  if (TIMESTAMP_HEX_LEN != MHD_strx_to_uint32_n_ (nonce + len - TIMESTAMP_HEX_LEN,
+                                                  TIMESTAMP_HEX_LEN, &nonce_time))
+    {
+#ifdef HAVE_MESSAGES
+      MHD_DLOG (connection->daemon,
+                "Authentication failed, invalid timestamp format.\n");
+#endif
+      return MHD_NO;
+    }
   t = (uint32_t) MHD_monotonic_sec_counter();
   /*
    * First level vetting for the nonce validity: if the timestamp