From 0c8cf64cc141cbb417997aedbc401979ca71949b Mon Sep 17 00:00:00 2001 From: Guido Vranken Date: Fri, 16 Jun 2017 02:58:56 +0200 Subject: [PATCH] Fix a null-pointer dereference in establish_http_proxy_passthru() Prevents that the client crashes if the peer does not specify the 'realm' and/or 'nonce' values. These pointers are dereferenced in DigestCalcHA1() and DigestCalcResponse(); hence, if not set, a null-pointer dereference would occur. Signed-off-by: Guido Vranken Acked-by: Gert Doering Message-Id: <1497574736-2092-1-git-send-email-gv@guidovranken.nl> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14844.html Signed-off-by: Gert Doering (cherry picked from commit 14865773ad64d861128bc80ad44c37bdc307c996) (cherry picked from commit 479b6d13d8c230c11b6315665bf00998a1424eef) --- proxy.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/proxy.c b/proxy.c index 0502ce99..72f64cd6 100644 --- a/proxy.c +++ b/proxy.c @@ -745,6 +745,12 @@ establish_http_proxy_passthru (struct http_proxy_info *p, const char *algor = get_pa_var("algorithm", pa, &gc); const char *opaque = get_pa_var("opaque", pa, &gc); + if ( !realm || !nonce ) + { + msg(D_LINK_ERRORS, "HTTP proxy: digest auth failed, malformed response from server: realm= or nonce= missing" ); + goto error; + } + /* generate a client nonce */ ASSERT(RAND_bytes(cnonce_raw, sizeof(cnonce_raw))); cnonce = make_base64_string2(cnonce_raw, sizeof(cnonce_raw), &gc);