summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorwolfbeast <mcwerewolf@wolfbeast.com>2020-01-09 22:35:03 +0100
committerwolfbeast <mcwerewolf@wolfbeast.com>2020-01-11 13:46:18 +0100
commit38b00414148f4b013499b759ba3cd6cb72a15179 (patch)
tree164797490b3a541b1c4c67e79e04a73cf1c5cdb6
parentd62795c868dff9a12a8868d09b3331cb8c4ad39b (diff)
downloaduxp-38b00414148f4b013499b759ba3cd6cb72a15179.tar.gz
Handle missing base64 challenge in NegotiateAuth and NTLMAuth.
-rw-r--r--extensions/auth/nsHttpNegotiateAuth.cpp5
-rw-r--r--netwerk/protocol/http/nsHttpNTLMAuth.cpp4
2 files changed, 6 insertions, 3 deletions
diff --git a/extensions/auth/nsHttpNegotiateAuth.cpp b/extensions/auth/nsHttpNegotiateAuth.cpp
index adea54b850..8b6be915e9 100644
--- a/extensions/auth/nsHttpNegotiateAuth.cpp
+++ b/extensions/auth/nsHttpNegotiateAuth.cpp
@@ -530,8 +530,11 @@ nsHttpNegotiateAuth::GenerateCredentials(nsIHttpAuthenticableChannel *authChanne
challenge++;
len = strlen(challenge);
+ if (!len)
+ return NS_ERROR_UNEXPECTED;
+
// strip off any padding (see bug 230351)
- while (challenge[len - 1] == '=')
+ while (len && challenge[len - 1] == '=')
len--;
//
diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.cpp b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
index aa5b1f8f7e..86bfcf4d13 100644
--- a/netwerk/protocol/http/nsHttpNTLMAuth.cpp
+++ b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
@@ -486,8 +486,8 @@ nsHttpNTLMAuth::GenerateCredentials(nsIHttpAuthenticableChannel *authChannel,
len -= 5;
// strip off any padding (see bug 230351)
- while (challenge[len - 1] == '=')
- len--;
+ while (len && challenge[len - 1] == '=')
+ len--;
// decode into the input secbuffer
rv = Base64Decode(challenge, len, (char**)&inBuf, &inBufLen);