tree 67909c1d6c15bf3b0eaedcc666dee537ac6b83a3
parent 0239f32c3052a4e63e32c9a469ba572344d76c65
author Willy Tarreau <w@1wt.eu> 1706088665 +0100
committer Willy Tarreau <w@1wt.eu> 1707932573 +0100
encoding latin1

BUG/MINOR: jwt: fix jwt_verify crash on 32-bit archs

The jwt_verify converter was added in 2.5 with commit 130e142ee2
("MEDIUM: jwt: Add jwt_verify converter to verify JWT integrity"). It
takes a string on input and returns an integer. It turns out that by
presetting the return value to zero before processing contents, while
the sample data is a union, it overwrites the beginning of the buffer
struct passed on input. On a 64-bit arch it's not an issue because it's
where the allocated size is stored and it's not used in the operation,
which explains why the regtest works. But on 32-bit, both the size and
the pointer are overwritten, causing a NULL pointer to be passed to
jwt_tokenize() which is not designed to support this, hence crashes.

Let's just use a temporary variable to hold the result and move the
output sample initialization to the end of the function.

This should be backported as far as 2.5.

(cherry picked from commit e41638af33d76660220ce2e3ed613e8a24fb6e55)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 79ab2bc2a498c76b7fe43fe37d6dabd827f1ca50)
Signed-off-by: Willy Tarreau <w@1wt.eu>