You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2026/08/27 17:31:36 UTC
svn commit: r1937526 - httpd/httpd/trunk/modules/aaa
Author: covener
Date: Thu Aug 27 17:31:35 2026
New Revision: 1937526
Log:
fix off-by-one buffer over-read in autht_jwt check_token
Submitted by: arshiya tabasum <ar...@bugqore.com>
Github: closes #704
Modified:
httpd/httpd/trunk/modules/aaa/mod_autht_jwt.c
Modified: httpd/httpd/trunk/modules/aaa/mod_autht_jwt.c
==============================================================================
--- httpd/httpd/trunk/modules/aaa/mod_autht_jwt.c Thu Aug 27 17:31:07 2026 (r1937525)
+++ httpd/httpd/trunk/modules/aaa/mod_autht_jwt.c Thu Aug 27 17:31:35 2026 (r1937526)
@@ -1051,7 +1051,7 @@ static autht_status check_token(request_
}
key = apr_psprintf(r->pool, AUTHT_PREFIX "%.*s", (int)kv->k->value.string.len, kv->k->value.string.p);
- j = sizeof(AUTHT_PREFIX);
+ j = sizeof(AUTHT_PREFIX) - 1; /* string length of "TOKEN_", excluding the trailing NUL */
while (key[j]) {
if (apr_isalnum(key[j])) {
key[j] = apr_toupper(key[j]);