Backport htdigest buffer overflow fixes from 2.1

Reviewed by: Andre Malo, Jeff Trawick

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/APACHE_2_0_BRANCH@99783 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index e70626c1b909a4c7fb2512dd3686acb7bc5bdc8e..fd86e92b0612212ca43c69f5e13f18c46e617aaa 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,7 @@
 Changes with Apache 2.0.46
 
+  *) forward port of buffer overflow fixes for htdigest. [Thom May]
+
   *) Added AllowEncodedSlashes directive to permit control of whether
      the server will accept encoded slashes ('%2f') in the URI path.
      Default condition is off (the historical behaviour).  This permits

diff --git a/STATUS b/STATUS
index 59109053b172390abe562a2547a37d92b399f195..57f8d0b9cb28ce38e6daca745096db7e947a1521 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -1,5 +1,5 @@
 APACHE 2.0 STATUS:                                              -*-text-*-
-Last modified at [$Date: 2003/05/13 15:10:46 $]
+Last modified at [$Date: 2003/05/13 15:39:07 $]
 
 Release:
 
@@ -228,9 +228,6 @@ PATCHES TO PORT FROM 2.1
       server/core.c r1.232+r1.235
       +1: trawick, stoddard
 
-    * Fix for a pair of potential buffer overflows in htdigest.
-      support/htdigest.c r1.36
-      +1: thommay, nd, trawick
 
     * Hook mod_rewrite's type checker before mod_mime's one. That way the
       RewriteRule [T=...] Flag should work as expected now. PR 19626.

diff --git a/support/htdigest.c b/support/htdigest.c
index ece9173d6dae30e3ef4d6bb7c0617afcc3c43a65..79d71714007c53ebf7e789dfb0169f3aee6a715f 100644 (file)
--- a/support/htdigest.c
+++ b/support/htdigest.c
@@ -307,8 +307,8 @@ int main(int argc, const char * const argv[])
        fprintf(stderr, "Use -c option to create new one.\n");
        cleanup_tempfile_and_exit(1);
     }
-    strcpy(user, argv[3]);
-    strcpy(realm, argv[2]);
+    apr_cpystrn(user, argv[3], sizeof(user));
+    apr_cpystrn(realm, argv[2], sizeof(realm));
 
     found = 0;
     while (!(get_line(line, MAX_STRING_LEN, f))) {