romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 13:07:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

digest: reject broken header with session protocol but without qop

Browse source 
Closes #9077
This commit is contained in:
Evgeny Grin (Karlson2k) 2022-06-30 18:30:21 +03:00 • committed by Daniel Stenberg
parent b6dd849fa3
commit 3fe24ea322
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/vauth/digest.c
View file

@ -637,6 +637,10 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
if(!digest->nonce)
return CURLE_BAD_CONTENT_ENCODING;
/* "<algo>-sess" protocol versions require "auth" or "auth-int" qop */
if(!digest->qop && (digest->algo & SESSION_ALGO))
return CURLE_BAD_CONTENT_ENCODING;
return CURLE_OK;
}