alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-01-20 09:27:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_http_client): prevent out-of-bounds read in Digest auth

Browse Source 
Fixed vulnerability where malicious HTTP servers could trigger OOB reads
by sending empty or very short algorithm fields in WWW-Authenticate headers.

Changes:
- Replace unsafe memcmp() with strcasecmp() for algorithm comparison
- Add algorithm NULL validation at function entry point
- Fix duplicate md5-sess check, add missing SHA-256 check
This commit is contained in:
Mahavir Jain
2025-11-21 15:54:14 +05:30
parent 64726df15e
commit bbcc13be8b
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
components/esp_http_client/lib/http_auth.c
View File

@@ -122,14 +122,15 @@ char *http_auth_digest(const char *username, const char *password, esp_http_auth
password == NULL ||
auth_data->nonce == NULL ||
auth_data->uri == NULL ||
auth_data->realm == NULL) {
auth_data->realm == NULL ||
auth_data->algorithm == NULL) {
return NULL;
}
int digest_size = MD5_MAX_LEN;
int (*digest_func)(char *digest, const char *fmt, ...) = md5_printf;
if (!memcmp(auth_data->algorithm, "SHA256", strlen("SHA256")) ||
!memcmp(auth_data->algorithm, "SHA-256", strlen("SHA-256"))) {
if (strcasecmp(auth_data->algorithm, "SHA256") == 0 ||
strcasecmp(auth_data->algorithm, "SHA-256") == 0) {
digest_size = SHA256_HEX_LEN;
digest_func = sha256_sprintf;
}
@@ -150,7 +151,7 @@ char *http_auth_digest(const char *username, const char *password, esp_http_auth
ESP_LOGD(TAG, "%s %s %s %s", "Digest", username, auth_data->realm, password);
if ((strcasecmp(auth_data->algorithm, "md5-sess") == 0) ||
(strcasecmp(auth_data->algorithm, "SHA256") == 0) ||
(strcasecmp(auth_data->algorithm, "md5-sess") == 0)) {
(strcasecmp(auth_data->algorithm, "SHA-256") == 0)) {
if (digest_func(ha1, "%s:%s:%016llx", ha1, auth_data->nonce, auth_data->cnonce) <= 0) {
goto _digest_exit;
}