tree 09f3f6c9f2d4bd7fa508a80ec23c065325b11615
parent 24b8d693b202b01b649f64ed878d8f9dd1b242e4
author Tim Duesterhus <tim@bastelstu.be> 1634575228 +0200
committer Willy Tarreau <w@1wt.eu> 1635407148 +0200
encoding latin1

CLEANUP: jwt: Remove the use of a trash buffer in jwt_jwsverify_hmac()

The OpenSSL documentation (https://www.openssl.org/docs/man1.1.0/man3/HMAC.html)
specifies:

> It places the result in md (which must have space for the output of the hash
> function, which is no more than EVP_MAX_MD_SIZE bytes). If md is NULL, the
> digest is placed in a static array. The size of the output is placed in
> md_len, unless it is NULL. Note: passing a NULL value for md to use the
> static array is not thread safe.

`EVP_MAX_MD_SIZE` appears to be defined as `64`, so let's simply use a stack
buffer to avoid the whole memory management.