BUG/MINOR: jwe: only match the exact "ALL" word in jwt.decrypt_{alg,enc}_list

The parsing of the special 'ALL' case in "jwt.decrypt_alg_list" and
"jwt.decrypt_enc_list" did not check the actual string length so a too
short string could be wrongly treated as 'ALL'.

This was introduced in 3.4 by commit f82a242c8 ("MINOR: jwe: Add option to
enable/disable algorithms or encryption algorithms for jwt_decrypt"), so
the fix must be backported to 3.4.

diff --git a/src/jwe.c b/src/jwe.c
index 0ab480683c8d72956b27dac4bd8d0ad5a66b392a..e29ac8182ca117f30f3f5e44e9e35a3bebd96001 100644 (file)
--- a/src/jwe.c
+++ b/src/jwe.c
@@ -2274,7 +2274,7 @@ static int jwe_parse_global_alg_enc_list(char **args, int section_type, struct p
 
                /* If "ALL" is used all previously disabled algo will be
                 * reenabled */
-               if (strncmp(alg, "ALL", alg_end - alg) == 0) {
+               if (alg_end - alg == 3 && strncmp(alg, "ALL", alg_end - alg) == 0) {
                        set_all_alg_enc_flags(arr, ALG_ENC_ENABLED);
                } else {
                        if (set_alg_enc_flag(arr, alg, alg_end-alg, value) != 0) {