Jose Kahan pointed out a Digest server that provided the algorith last in the

header line without quotes and with a CRLF immediately following...

diff --git a/lib/http_digest.c b/lib/http_digest.c
index c223784f9124fd9fc4b5779861d34acdff5e4b5a..604655f040153cf5cb281916a5641c2f514d9b01 100644 (file)
--- a/lib/http_digest.c
+++ b/lib/http_digest.c
@@ -101,8 +101,8 @@ CURLdigest Curl_input_digest(struct connectdata *conn,
       if((2 == sscanf(header, "%31[^=]=\"%127[^\"]\"",
                       value, content)) ||
          /* try the same scan but without quotes around the content but don't
-            include the possibly trailing comma */
-         (2 ==  sscanf(header, "%31[^=]=%127[^,]",
+            include the possibly trailing comma, newline or carriage return */
+         (2 ==  sscanf(header, "%31[^=]=%127[^\r\n,]",
                        value, content)) ) {
         if(strequal(value, "nonce")) {
           d->nonce = strdup(content);