libmicrohttpd

commit 300a2ab01c84de26d00c4989004de7c7b5549025
parent 888606e0040fdb8e80e0933ad9e1fed31cafc5ce
Author: Christian Grothoff <christian@grothoff.org>
Date:   Tue, 28 Jul 2026 10:59:19 +0200

handle empty username and empty realm provided by client gracefully

Diffstat:
M
src/microhttpd/digestauth.c
 | 
5
+++++

1 file changed, 5 insertions(+), 0 deletions(-)
diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c
@@ -2684,6 +2684,9 @@ digest_auth_check_all_inner (struct MHD_Connection *connection,
   else if ((NULL != params->username.value.str) &&
            (NULL != params->username_ext.value.str))
     return MHD_DAUTH_WRONG_USERNAME; /* Parameters cannot be used together */
+  else if ((NULL != params->username.value.str) &&
+           (0 == params->username.value.len))
+    return MHD_DAUTH_WRONG_USERNAME;  /* Empty username */
   else if ((NULL != params->username_ext.value.str) &&
            (MHD_DAUTH_EXT_PARAM_MIN_LEN > params->username_ext.value.len))
     return MHD_DAUTH_WRONG_USERNAME;  /* Broken extended notation */
@@ -2696,6 +2699,8 @@ digest_auth_check_all_inner (struct MHD_Connection *connection,
 
   if (NULL == params->realm.value.str)
     return MHD_DAUTH_WRONG_REALM;
+  else if (0 == params->realm.value.len)
+    return MHD_DAUTH_WRONG_REALM;  /* Empty realm */
   else if (((NULL == userdigest) || params->userhash) &&
            (_MHD_AUTH_DIGEST_MAX_PARAM_SIZE < params->realm.value.len))
     return MHD_DAUTH_TOO_LARGE; /* Realm is too large and should be used in hash calculations */