cjose
cjose copied to clipboard
memory allocation error
in jwe.c, on line 1952:
cek = cjose_get_alloc()(cek_len);
memcpy(cek, jwe->cek, cek_len);
Allocation result is not checked. We should add
if (!cek) {
CJOSE_ERROR(err, CJOSE_ERR_NO_MEMORY);
return NULL;
}
this is now part of the maintenance fork here: https://github.com/OpenIDC/cjose/tree/version-0.6.2.x