jwt_parse_alg would mistakenly return JWT_ALG_NONE for algorithms "",
"n", "no" and "non" because of a strncmp misuse. It now sees them as
unknown algorithms.
No backport needed.
---
src/jwt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/jwt.c b/src/jwt.c
index 94bfa5adb..8c4537542 100644
--- a/src/jwt.c
+++ b/src/jwt.c
@@ -34,7 +34,7 @@ enum jwt_alg jwt_parse_alg(const char *alg_str, unsigned int
alg_len)
/* Algorithms are all 5 characters long apart from "none". */
if (alg_len < sizeof("HS256")-1) {
- if (strncmp("none", alg_str, alg_len) == 0)
+ if (alg_len == sizeof("none")-1 && strcmp("none", alg_str) == 0)
alg = JWS_ALG_NONE;
return alg;
}
--
2.32.0
