func isReqAuthenticated(r *http.Request, region string) (s3Error APIErrorCode) {
	if r == nil {
		return ErrInternalError
	}

	if errCode := reqSignatureV4Verify(r, region); errCode != ErrNone {
		return errCode
	}

	payload, err := ioutil.ReadAll(r.Body)
	if err != nil {
		logger.LogIf(context.Background(), err)
		return ErrInternalError
	}

	// Populate back the payload.
	r.Body = ioutil.NopCloser(bytes.NewReader(payload))

	// Verify Content-Md5, if payload is set.
	if clntMD5B64, ok := r.Header["Content-Md5"]; ok {
		if clntMD5B64[0] == "" {
			return ErrInvalidDigest
		}
		md5Sum, err := base64.StdEncoding.Strict().DecodeString(clntMD5B64[0])
		if err != nil {
			return ErrInvalidDigest
		}
		if !bytes.Equal(md5Sum, getMD5Sum(payload)) {
			return ErrBadDigest
		}
	}

	if skipContentSha256Cksum(r) {
		return ErrNone
	}

	// Verify that X-Amz-Content-Sha256 Header == sha256(payload)
	// If X-Amz-Content-Sha256 header is not sent then we don't calculate/verify sha256(payload)
	sumHex, ok := r.Header["X-Amz-Content-Sha256"]
	if isRequestPresignedSignatureV4(r) {
		sumHex, ok = r.URL.Query()["X-Amz-Content-Sha256"]
	}
	if ok {
		if sumHex[0] == "" {
			return ErrContentSHA256Mismatch
		}
		sum, err := hex.DecodeString(sumHex[0])
		if err != nil {
			return ErrContentSHA256Mismatch
		}
		if !bytes.Equal(sum, getSHA256Sum(payload)) {
			return ErrContentSHA256Mismatch
		}
	}
	return ErrNone
}
The software allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how many descriptors can be allocated, in violation of the intended security policy for that actor.