From 9c455501a7382df3908e3239398ded9c1379816a Mon Sep 17 00:00:00 2001 From: DualFroz Date: Tue, 13 Oct 2026 23:02:54 +0200 Subject: [PATCH] http_auth: fix NULL dereference on missing Digest response values A server could reply with an Authentication-Info header carrying a cnonce but no rspauth, which was passed to strcmp() as NULL. Treat a missing rspauth as an authentication failure, and do not compare the cnonce against a client nonce that was never generated. Fixes #30043 --- src/network/http_auth.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/network/http_auth.c b/src/network/http_auth.c index 572db69..5101b1c 100644 --- a/src/network/http_auth.c +++ b/src/network/http_auth.c @@ -301,7 +301,8 @@ int vlc_http_auth_ParseAuthenticationInfoHeader( if ( psz_cnonce ) { - if ( strcmp( psz_cnonce, p_auth->psz_cnonce ) != 0 ) + if ( p_auth->psz_cnonce == NULL || + strcmp( psz_cnonce, p_auth->psz_cnonce ) != 0 ) { msg_Err( p_this, "HTTP Digest Access Authentication: server " "replied with a different client nonce value." ); @@ -336,7 +337,8 @@ int vlc_http_auth_ParseAuthenticationInfoHeader( */ psz_digest = AuthDigest( p_this, p_auth, psz_method, psz_path, psz_username, psz_password ); - if( psz_digest == NULL || strcmp( psz_digest, psz_rspauth ) != 0 ) + if( psz_digest == NULL || psz_rspauth == NULL || + strcmp( psz_digest, psz_rspauth ) != 0 ) { msg_Err( p_this, "HTTP Digest Access Authentication: server " "replied with an invalid response digest "