htdigest: Fix buffer overflow when reading digest

password file with very long lines.

PR 54893.

Backport of r1475878 from trunk resp.
r1476089 from 2.4.x resp. r1476242
from 2.2.x.

Proposed/Backported by: rjung
Reviewed by: minfrin, wrowe

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@1489893 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 610e9d93290900c7fe84de8e5a87f9800fa39044..00f14fdadd4a8372d11d48f7249b877bff9e20e9 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -28,6 +28,9 @@ Changes with Apache 2.0.65
      is enabled, could allow local users to gain privileges via a .htaccess
      file. [Stefan Fritsch, Greg Ames]
 
+  *) htdigest: Fix buffer overflow when reading digest password file
+     with very long lines. PR 54893. [Rainer Jung]
+
   *) mod_ssl: Add "SSLHonorCipherOrder" directive to enable the
      OpenSSL 0.9.7 flag which uses the server's cipher order rather
      than the client's.  PR 28665.

diff --git a/STATUS b/STATUS
index d562ec6e6c6e33ae24b0fbd0c869858f5443a80c..5f0d4b92342a75aefee4c1a39f37ff89922fea3c 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -188,15 +188,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  * htdigest: Fix buffer overflow when reading digest
-    password file with very long lines. PR 54893.
-    trunk patch: https://svn.apache.org/r1475878
-    2.4.x patch: https://svn.apache.org/11476089
-    2.2.x patch: https://svn.apache.org/r1476242
-    2.0.x patch: http://people.apache.org/~rjung/patches/htdigest-buffer_overflow_2_0.patch
-    +1: rjung, minfrin, wrowe
-    -1: 
-
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ please place SVN revisions from trunk here, so it is easy to

diff --git a/support/htdigest.c b/support/htdigest.c
index 55699ad16690a6a491dd5fbc7885c21698cbd327..60f6611d61f83b8d9e3e266958de5ac771625167 100644 (file)
--- a/support/htdigest.c
+++ b/support/htdigest.c
@@ -96,12 +96,15 @@ static int get_line(char *s, int n, apr_file_t *f)
     char ch;
     apr_status_t rv = APR_EINVAL;
 
-    while (i < (n - 1) && 
+    /* we need 2 remaining bytes in buffer */
+    while (i < (n - 2) &&
            ((rv = apr_file_getc(&ch, f)) == APR_SUCCESS) && (ch != '\n')) {
         s[i++] = ch;
     }
+    /* First remaining byte potentially used here */
     if (ch == '\n')
         s[i++] = ch;
+    /* Second remaining byte used here */
     s[i] = '\0';
 
     if (rv != APR_SUCCESS)