Fix a null-pointer dereference in establish_http_proxy_passthru()

From: Guido Vranken <[email protected]...>

Prevents that the client crashes if the peer does not specify the 'realm' and/or 'nonce' values. These pointers are dereferenced in DigestCalcHA1() and DigestCalcResponse(); hence, if not set, a null-pointer dereference would occur.

---
 src/openvpn/proxy.c | 7 +++++++
 1 file changed, 7 insertions(+)

index 05f362d..46cb2bb 100644
@@ -875,6 +875,13 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
                 const char *algor = get_pa_var("algorithm", pa, &gc);
                 const char *opaque = get_pa_var("opaque", pa, &gc);
 
+                if ( !realm || !nonce )
+                {
+                    msg(D_LINK_ERRORS, "HTTP proxy: digest auth failed, malformed response "
+                            "from server: realm= or nonce= missing" );
+                    goto error;
+                }
+
                 /* generate a client nonce */
                 ASSERT(rand_bytes(cnonce_raw, sizeof(cnonce_raw)));
                 cnonce = make_base64_string2(cnonce_raw, sizeof(cnonce_raw), &gc);

2.1.4

ACK, thanks. Stared-at-code, and ran normal proxy tests, not having a malicious proxy at hand to actually trigger that error.

(And thanks for using git-send-email, makes my life much easier ;-) )

Your patch has been applied to the master, release/2.4, 2.3 and 2.2 branch (2.2 and 2.3 with whitespace reformatting to match coding style).

commit 14865773ad64d861128bc80ad44c37bdc307c996 (master) commit bf547b8ac79b15a2b2dc59e27c0cb2ade73a3941 (release/2.4) commit 479b6d13d8c230c11b6315665bf00998a1424eef (release/2.3) commit 0c8cf64cc141cbb417997aedbc401979ca71949b (release/2.2)

Author: Guido Vranken
Date:   Fri Jun 16 02:58:56 2017 +0200

     Fix a null-pointer dereference in establish_http_proxy_passthru()

     Signed-off-by: Guido Vranken <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg14844.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering