Subject: auth-digest: Handle missing realm in authenticate header
From: Patrick Griffis <[email-masked]>
Date: Sun, 8 Dec 2024 20:00:35 -0600

(cherry picked from commit e40df6d48a1cbab56f5d15016cc861a503423cfe)

Upstream-Status: Backport [import from debian https://salsa.debian.org/gnome-team/libsoup/-/blob/debian/bullseye/debian/patches/CVE-2025-32910-1.patch?ref_type=heads
Upstream commit https://gitlab.gnome.org/GNOME/libsoup/-/commit/e40df6d48a1cbab56f5d15016cc861a503423cfe]
CVE: CVE-2025-32910
Signed-off-by: Vijay Anusuri <[email-masked]>

Remove test code for fixing do_compile failure of libsoup-2.4, test codes include
new type added in 3.x version
../libsoup-2.74.3/tests/auth-test.c:1554:39: error: unknown type name 'SoupServerMessage'; did you mean 'SoupServerClass'?
 1554 |                                       SoupServerMessage *msg,
      |                                       ^~~~~~~~~~~~~~~~~

Signed-off-by: Changqing Li <[email-masked]>
---
 libsoup/soup-auth-digest.c |  3 +++
 1 files changed, 3 insertions(+)

diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
index e8ba990..263a15a 100644
--- a/libsoup/soup-auth-digest.c
+++ b/libsoup/soup-auth-digest.c
@@ -142,6 +142,9 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
 	guint qop_options;
 	gboolean ok = TRUE;
 
+        if (!soup_auth_get_realm (auth))
+                return FALSE;
+
 	g_free (priv->domain);
 	g_free (priv->nonce);
 	g_free (priv->opaque);