htdigest: Fix buffer overflow when reading digest

password file with very long lines.

PR 54893.

Backport of r1475878 from trunk.

Proposed/Backported by: rjung
Reviewed by: humbedooh, covener

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1476089 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 7110bd3ba4cedb8000514e57053182bca61fbec4..7aa1f49a6d564683f545b21a9f15bcea9996fa06 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,9 @@
  
 Changes with Apache 2.4.5
 
+  *) htdigest: Fix buffer overflow when reading digest password file
+     with very long lines. PR 54893. [Rainer Jung]
+
   *) ap_expr: Add the ability to base64 encode and base64 decode
      strings and to generate their SHA1 hash.  [Graham Leggett]
 

diff --git a/STATUS b/STATUS
index 37848d55d754cc076031ebeed9a644bd8c1a0362..ab090fe984d5ebb996d9111684c208e341bbc400 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -95,12 +95,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
       2.4.x patch: trunk patches work
       +1: sf, humbedooh, covener
 
-    * htdigest: Fix buffer overflow when reading digest
-      password file with very long lines. PR 54893.
-      trunk patches: https://svn.apache.org/r1475878
-      2.4.x patch: trunk patches work
-      +1: rjung, humbedooh, covener
-
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]

diff --git a/support/htdigest.c b/support/htdigest.c
index a8b464aedda3ca1ed6889de4fc18eda9621af640..f76036d7a5bd34e3e583d0f8e6027d2e7fe64482 100644 (file)
--- a/support/htdigest.c
+++ b/support/htdigest.c
@@ -96,12 +96,15 @@ static int get_line(char *s, int n, apr_file_t *f)
     char ch;
     apr_status_t rv = APR_EINVAL;
 
-    while (i < (n - 1) &&
+    /* we need 2 remaining bytes in buffer */
+    while (i < (n - 2) &&
            ((rv = apr_file_getc(&ch, f)) == APR_SUCCESS) && (ch != '\n')) {
         s[i++] = ch;
     }
+    /* First remaining byte potentially used here */
     if (ch == '\n')
         s[i++] = ch;
+    /* Second remaining byte used here */
     s[i] = '\0';
 
     if (rv != APR_SUCCESS)