Changeset 1875

Timestamp:

06/15/2007 04:22:30 PM (15 months ago)

Author:

jan

Message:

* fixed mem-leak in mod_auth (reported by Stefan Esser)
* fixed crash with md5-sess and cnonce not set in mod_auth (reported

by Stefan Esser)

* fixed missing check for base64 encoded string in mod_auth and Basic

auth (reported by Stefan Esser)

* fixed possible crash in Auth-Digest header parser on trailing WS in

mod_auth (reported by Stefan Esser)

Location:

branches/lighttpd-1.4.x

Files:

• NEWS (modified) (1 diff)
• src/http_auth.c (modified) (3 diffs)
• tests/mod-auth.t (modified) (2 diffs)

branches/lighttpd-1.4.x/NEWS

@@ -14 +14 @@
   * fixed crash on duplicate headers with trailing WS (#1232)
   * fixed accepting more connections then requested (#1216)
+  * fixed mem-leak in mod_auth (reported by Stefan Esser)
+  * fixed crash with md5-sess and cnonce not set in mod_auth (reported by Stefan Esser)
+  * fixed missing check for base64 encoded string in mod_auth and Basic auth
+    (reported by Stefan Esser)
+  * fixed possible crash in Auth-Digest header parser on trailing WS in 
+    mod_auth (reported by Stefan Esser) 
 
 - 1.4.15 - 2007-04-13

branches/lighttpd-1.4.x/src/http_auth.c

@@ -831 +831 @@
         username = buffer_init();
 
-        base64_decode(username, realm_str);
+        if (!base64_decode(username, realm_str)) {
+                buffer_free(username);
+
+                log_error_write(srv, __FILE__, __LINE__, "sb", "decodeing base64-string failed", username);
+
+                return 0;
+        }
 
         /* r2 == user:password */
@@ -968 +974 @@
                 /* skip whitespaces */
                 while (*c == ' ' || *c == '\t') c++;
-                if (!c) break;
+                if (!*c) break;
 
                 for (i = 0; dkv[i].key; i++) {
@@ -1017 +1023 @@
                 log_error_write(srv, __FILE__, __LINE__, "s",
                                 "digest: missing field");
+
+                buffer_free(b);
+                return -1;
+        }
+
+        /**
+         * protect the md5-sess against missing cnonce and nonce
+         */
+        if (algorithm &&
+            0 == strcasecmp(algorithm, "md5-sess") &&
+            (!nonce || !cnonce)) {
+                log_error_write(srv, __FILE__, __LINE__, "s",
+                                "digest: (md5-sess: missing field");
+
+                buffer_free(b);
                 return -1;
         }

branches/lighttpd-1.4.x/tests/mod-auth.t

@@ -9 +9 @@
 use strict;
 use IO::Socket;
-use Test::More tests => 10;
+use Test::More tests => 13;
 use LightyTest;
 
@@ -94 +94 @@
 ok($tf->handle_http($t) == 0, 'Digest-Auth: missing nc (noncecount instead), no crash');
 
+$t->{REQUEST}  = ( <<EOF
+GET /server-status HTTP/1.0
+Authorization: Basic =
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
+ok($tf->handle_http($t) == 0, 'Basic-Auth: Invalid Base64');
+
+
+$t->{REQUEST}  = ( <<EOF
+GET /server-status HTTP/1.0
+User-Agent: Wget/1.9.1
+Authorization: Digest username="jan", realm="jan",
+        nonce="b1d12348b4620437c43dd61c50ae4639", algorithm="md5-sess",
+        uri="/MJ-BONG.xm.mpc", qop=auth, noncecount=00000001",
+        cnonce="036FCA5B86F7E7C4965C7F9B8FE714B7",
+        nc="asd",
+        response="29B32C2953C763C6D033C8A49983B87E"
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
+ok($tf->handle_http($t) == 0, 'Digest-Auth: md5-sess + missing cnonce');
+
+$t->{REQUEST}  = ( <<EOF
+GET /server-status HTTP/1.0
+User-Agent: Wget/1.9.1
+Authorization: Digest username="jan", realm="jan",
+        nonce="b1d12348b4620437c43dd61c50ae4639", algorithm="md5-sess",
+        uri="/MJ-BONG.xm.mpc", qop=auth, noncecount=00000001",
+        cnonce="036FCA5B86F7E7C4965C7F9B8FE714B7",
+        nc="asd",
+        response="29B32C2953C763C6D033C8A49983B87E"     
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ];
+ok($tf->handle_http($t) == 0, 'Digest-Auth: trailing WS');
+