libmicrohttpd

commit 5a73c1ae819240fbc1a32b4abd13688f60f4bacc
parent c13f4c6484febc80e6533144600acb58ce469db6
Author: Christian Grothoff <christian@grothoff.org>
Date:   Mon, 27 Jul 2026 18:11:25 +0200

ensure digest authentication hex decoder does not overflow if give hex-encoded userhash is too long (potential out-of-bounds stack write); thanks to A. Ramos for reporting

Diffstat:
M
src/microhttpd/digestauth.c
 | 
7
++++++-

1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c
@@ -2959,7 +2959,12 @@ digest_auth_check_all_inner (struct MHD_Connection *connection,
                                 &unquoted);
   if (_MHD_UNQ_OK != unq_res)
     return MHD_DAUTH_ERROR;
-  if (digest_size != MHD_hex_to_bin (unquoted.str, unquoted.len, hash1_bin))
+  if (unquoted.len > MAX_AUTH_RESPONSE_LENGTH)
+    return MHD_DAUTH_ERROR;
+  if (digest_size !=
+      MHD_hex_to_bin (unquoted.str,
+                      unquoted.len,
+                      hash1_bin))
     return MHD_DAUTH_RESPONSE_WRONG;
 
   /* Update digest with ':' */