* modules/aaa/mod_auth_digest.c (get_digest_rec):

  Parse opaque more strictly.

GitHub: PR #661

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935949 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/aaa/mod_auth_digest.c b/modules/aaa/mod_auth_digest.c
index f8ba85f74216af7e90a90498225628aa21abfd80..4df37246fa1f3e4a923e912aa8808bdf60f46aea 100644 (file)
--- a/modules/aaa/mod_auth_digest.c
+++ b/modules/aaa/mod_auth_digest.c
@@ -950,7 +950,13 @@ static int get_digest_rec(request_rec *r, digest_header_rec *resp)
     }
 
     if (resp->opaque) {
-        resp->opaque_num = (unsigned long) strtol(resp->opaque, NULL, 16);
+        char *endptr;
+        long num;
+
+        errno = 0;
+        num = strtol(resp->opaque, &endptr, 16);
+        if (errno == 0 && *endptr == '\0' && num > 0)
+            resp->opaque_num = (unsigned long)num;
     }
 
     resp->auth_hdr_sts = VALID;