From d275f881834bb8340555a390cc9b237ab5baa761 Mon Sep 17 00:00:00 2001
From: david <david@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Wed, 18 Aug 2010 18:16:22 +0000
Subject: [PATCH] Fix two bugs in http.read_auth_challenge reported by Tom
 Sellers. The first was that pos was declared as a local variable and shadowed
 the pos parameter. The second was that when multiple WWW-Authenticate headers
 were present, the wrong pos would be returned after reading the first one.
 The arrow shows the pos it was returning:

Digest realm="My Site", domain="/", Basic realm="My Site"
                                          ^

It now returns this correct pos, ready to read the next challenge:

Digest realm="My Site", domain="/", Basic realm="My Site"
                                    ^

This was a problem I had already solved for Ncat but I copied the logic
imperfectly to http.lua.
---
 nselib/http.lua | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/nselib/http.lua b/nselib/http.lua
index 01db39e94..1f54c92c4 100644
--- a/nselib/http.lua
+++ b/nselib/http.lua
@@ -1410,7 +1410,7 @@ end
 -- See RFC 2617, section 1.2. This function returns a table with keys "scheme"
 -- and "params".
 local read_auth_challenge = function(s, pos)
-  local _, pos, scheme, params
+  local _, scheme, params
 
   pos, scheme = read_token(s, pos)
   if not scheme then
@@ -1421,13 +1421,24 @@ local read_auth_challenge = function(s, pos)
   pos = skip_space(s, pos)
   while pos < string.len(s) do
     local name, val
+    local tmp_pos
 
-    pos, name = read_token(s, pos)
-    pos = skip_space(s, pos)
-    if string.sub(s, pos, pos) ~= "=" then
+    -- We need to peek ahead at this point. It's possible that we've hit the
+    -- end of one challenge and the beginning of another. Section 14.33 says
+    -- that the header value can be 1#challenge, in other words several
+    -- challenges separated by commas. Because the auth-params are also
+    -- separated by commas, the only way we can tell is if we find a token not
+    -- followed by an equals sign.
+    tmp_pos = pos
+    tmp_pos, name = read_token(s, tmp_pos)
+    tmp_pos = skip_space(s, tmp_pos)
+    if string.sub(s, tmp_pos, tmp_pos) ~= "=" then
+      -- No equals sign, must be the beginning of another challenge.
       break
     end
-    pos = pos + 1
+    tmp_pos = tmp_pos + 1
+
+    pos = tmp_pos
     pos, val = read_token_or_quoted_string(s, pos)
     if params[name] then
       return nil