chibipub

commit 39d28abd18a4cc30f7e811e3f19b38bd5429797a
parent 2088d4293bf8c88f9aab9fae71790f83d52435e3
Author: William Casarin <jb55@jb55.com>
Date:   Sat, 16 Jan 2021 12:37:39 -0800

quick digest sanity check

Diffstat:
M
src/ap_json.c
 | 
17
++++++++++++++---

1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/src/ap_json.c b/src/ap_json.c
@@ -201,6 +201,7 @@ static int handle_wsdigest(struct ap_json *a)
 	size_t b64_len;
 	unsigned char hash[32];
 	unsigned char b64[128];
+	unsigned char *pos;
 
 	if (!handle_key(a, "@wsdigest")) {
 		note_error(&a->errs, "wsdigest key oob");
@@ -214,9 +215,19 @@ static int handle_wsdigest(struct ap_json *a)
 	sha256_hash(hash, a->req->body, a->req->body_len);
 	base64_encode(hash, 32, b64, sizeof(b64), &b64_len);
 
-	return push_str(c, "SHA-256=")
-		&& push_data(c, b64, b64_len)
-		&& push_str(c, "\",");
+	pos = c->p;
+
+	if (!(push_str(c, "SHA-256=") && push_data(c, b64, b64_len) )) {
+		return 0;
+	}
+
+	// quick sanity check
+	if ((b64_len+8) != (c->p - pos) || !memcmp(pos, b64, b64_len)) {
+		note_error(&a->errs, "bad digest");
+		return 0;
+	}
+
+	return push_str(c, "\",");
 }
 
 static int handle_ap_token(struct json_handlers *h, char token,