Created attachment 36400 [details]
fix race condition in mod_auth_digest

When there are requests made from multiple different users
on the same host to the same protection space, a race condition occurs
so that the realmhash from another user may sometimes
be used for validation when comparing digest with
expected digest.

I can reproduce this by running two testscripts which repeatedly requests a resource using different users.

script1:
while 1
curl -u test:test --digest "http://<ip>/cgi/mycgi.cgi"

script2:
while 1
curl -u test2:test2 --digest" http://<ip>/cgi/mycgi.cgi"

Sometimes the digest module will claim that there is a password mismatch APLOGNO(01792).

Debugging this i found that the realmhash (ha1) used to compare digests was sometimes from the wrong user.