From: Joe Orton <jorton@apache.org>
Date: Mon, 6 Jul 2026 12:51:50 +0000 (+0000)
Subject: * modules/aaa/mod_auth_digest.c (get_digest_rec):
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=81a13c618ba06680d8ed26335f21d29f34c8f19f;p=thirdparty%2Fapache%2Fhttpd.git

* modules/aaa/mod_auth_digest.c (get_digest_rec):
  Parse opaque more strictly.

GitHub: PR #661


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935949 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/aaa/mod_auth_digest.c b/modules/aaa/mod_auth_digest.c
index f8ba85f742..4df37246fa 100644
--- a/modules/aaa/mod_auth_digest.c
+++ b/modules/aaa/mod_auth_digest.c
@@ -950,7 +950,13 @@ static int get_digest_rec(request_rec *r, digest_header_rec *resp)
     }
 
     if (resp->opaque) {
-        resp->opaque_num = (unsigned long) strtol(resp->opaque, NULL, 16);
+        char *endptr;
+        long num;
+
+        errno = 0;
+        num = strtol(resp->opaque, &endptr, 16);
+        if (errno == 0 && *endptr == '\0' && num > 0)
+            resp->opaque_num = (unsigned long)num;
     }
 
     resp->auth_hdr_sts = VALID;