search

atomx / nginx-http-auth-digest

Digest Authentication for Nginx
Other
44 stars 14 forks source link

"nc" of response message is padding with 2 "00" #11

Closed zerodice0 closed 7 years ago

zerodice0 commented 7 years ago

So some language, like c/c++, is recognized to EOF. I guess it is caused by no \", then I added. :) Plz check this.

erikdubbelboer commented 7 years ago

Since nc is just a number it shouldn't matter if it's enclosed in quotes or not. Can you show me the case where this matters? I'm guessing you have some C/C++ library that parses the header incorrectly?

zerodice0 commented 7 years ago

I'm sorry but look 812 line. "qop=\"auth\", rspauth=\"%*s\", cnonce=\"%*s\", nc=%*s" 'NC' is not number, it is string. So if field->nc.len is not correct, then compiler fill 0 padding after real nc value. :( Are you really checked my fix? And my module just reading file until get EOF(\0). So I think it is not incorrectly parssing way.

to last, I'm sorry about my awful english skill. :(

erikdubbelboer commented 7 years ago

I looked into it again. The only way I can see this happening is if your request actually contains an nc with \0 in it. field->nc.len will always be correct. Anyways your patch does fix this if it happens and doesn't hurt anything, so I merged it. Thanks :)

Your english is more than good enough :)

zerodice0 commented 7 years ago

I got it. I'll check it again, too. Thanks :)