1 files changed, 15 insertions, 8 deletions

diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c
index d4e23fef..8f04bf38 100644
--- a/src/microhttpd/digestauth.c
+++ b/src/microhttpd/digestauth.c
@@ -732,6 +732,7 @@ calculate_nonce (uint32_t nonce_time,
  * @param connection the connection
  * @param key the key
  * @param value the value, can be NULL
+ * @param value_size number of bytes in @a value
  * @param kind type of the header
  * @return #MHD_YES if the key-value pair is in the headers,
  *         #MHD_NO if not
@@ -740,6 +741,7 @@ static int
 test_header (struct MHD_Connection *connection,
              const char *key,
              const char *value,
+             size_t value_size,
              enum MHD_ValueKind kind)
 {
   struct MHD_HTTP_Header *pos;
@@ -748,6 +750,8 @@ test_header (struct MHD_Connection *connection,
     {
       if (kind != pos->kind)
         continue;
+      if (value_size != pos->value_size)
+        continue;
       if (0 != strcmp (key,
                        pos->header))
         continue;
@@ -756,8 +760,9 @@ test_header (struct MHD_Connection *connection,
         return MHD_YES;
       if ( (NULL == value) ||
            (NULL == pos->value) ||
-           (0 != strcmp (value,
-                         pos->value)) )
+           (0 != memcmp (value,
+                         pos->value,
+                         value_size)) )
         continue;
       return MHD_YES;
     }
@@ -862,6 +867,7 @@ digest_auth_check_all (struct MHD_Connection *connection,
   uint32_t t;
   size_t left; /* number of characters left in 'header' for 'uri' */
   uint64_t nci;
+  char *qmark;
 
   VLA_CHECK_LEN_DIGEST(da->digest_size);
   header = MHD_lookup_connection_value (connection,
@@ -1072,15 +1078,17 @@ digest_auth_check_all (struct MHD_Connection *connection,
                           uri,
                           hentity,
                           da);
-
+    qmark = strchr (uri,
+                    '?');
+    if (NULL != qmark)
+      *qmark = '\0';
 
     /* Need to unescape URI before comparing with connection->url */
     daemon->unescape_callback (daemon->unescape_callback_cls,
                                connection,
                                uri);
-    if (0 != strncmp (uri,
-                      connection->url,
-                      strlen (connection->url)))
+    if (0 != strcmp (uri,
+                     connection->url))
     {
 #ifdef HAVE_MESSAGES
       MHD_DLOG (daemon,
@@ -1091,8 +1099,7 @@ digest_auth_check_all (struct MHD_Connection *connection,
     }
 
     {
-      const char *args = strchr (uri,
-                                 '?');
+      const char *args = qmark;
 
       if (NULL == args)
         args = "";