From: Michael Catanzaro Date: Thu, 8 May 2025 09:27:01 -0500 Subject: auth-digest: fix crash in soup_auth_digest_get_protection_space() We need to validate the Domain parameter in the WWW-Authenticate header. Unfortunately this crash only occurs when listening on default ports 80 and 443, so there's no good way to test for this. The test would require running as root. Origin: upstream, 3.7.0, commit:e64c221f9c7d09b48b610c5626b3b8c400f0907c Bug: https://gitlab.gnome.org/GNOME/libsoup/-/issues/440 Bug-CVE: https://security-tracker.debian.org/tracker/CVE-2025-4476 Bug-Debian: https://bugs.debian.org/1105887 --- libsoup/auth/soup-auth-digest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libsoup/auth/soup-auth-digest.c b/libsoup/auth/soup-auth-digest.c index d8bb291..292f204 100644 --- a/libsoup/auth/soup-auth-digest.c +++ b/libsoup/auth/soup-auth-digest.c @@ -220,7 +220,7 @@ soup_auth_digest_get_protection_space (SoupAuth *auth, GUri *source_uri) if (uri && g_strcmp0 (g_uri_get_scheme (uri), g_uri_get_scheme (source_uri)) == 0 && g_uri_get_port (uri) == g_uri_get_port (source_uri) && - !strcmp (g_uri_get_host (uri), g_uri_get_host (source_uri))) + !g_strcmp0 (g_uri_get_host (uri), g_uri_get_host (source_uri))) dir = g_strdup (g_uri_get_path (uri)); else dir = NULL;