digest: reject broken header with session protocol but without qop

Closes #9077

diff --git a/lib/vauth/digest.c b/lib/vauth/digest.c
index 9eac84098271d70b380a0672cde6f340ebf78101..afe83af1ad844a3c5d60b0bda3c0da20dfa0d35e 100644 (file)
--- a/lib/vauth/digest.c
+++ b/lib/vauth/digest.c
@@ -637,6 +637,10 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
   if(!digest->nonce)
     return CURLE_BAD_CONTENT_ENCODING;
 
+  /* "<algo>-sess" protocol versions require "auth" or "auth-int" qop */
+  if(!digest->qop && (digest->algo & SESSION_ALGO))
+    return CURLE_BAD_CONTENT_ENCODING;
+
   return CURLE_OK;
 }