diff options
| author | Hauke Mehrtens | 2026-04-23 22:12:48 +0000 |
|---|---|---|
| committer | Hauke Mehrtens | 2026-06-07 11:23:19 +0000 |
| commit | 53d2d11fb00d5cf19c1b30ab20b158ff664bd89e (patch) | |
| tree | 227e181adeaa295664108f77311d9fba619ecde3 | |
| parent | 645236607a3d4166fd01f91a158dcb04ccb34d73 (diff) | |
| download | uclient-53d2d11fb00d5cf19c1b30ab20b158ff664bd89e.tar.gz | |
uclient-http: fix NULL deref when digest WWW-Authenticate lacks params
strsep() sets *buf to NULL when the separator is not found. If the
server's WWW-Authenticate header consists of just an auth-scheme token
(e.g. "Digest") with no following space and parameters, the next
iteration dereferences NULL in the while(*next) loop.
Reject this input with -EINVAL instead.
Assisted-by: Claude:claude-opus-4-7
Link: https://github.com/openwrt/uclient/pull/16
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| -rw-r--r-- | uclient-http.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/uclient-http.c b/uclient-http.c index 2952e36..8132e5a 100644 --- a/uclient-http.c +++ b/uclient-http.c @@ -509,6 +509,10 @@ uclient_http_add_auth_digest(struct uclient_http *uh) /* skip auth type */ strsep(&buf, " "); + if (!buf) { + err = -EINVAL; + goto fail; + } next = buf; while (*next) { |