From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Thu, 15 Oct 2026 14:42:36 +0000 (+0200)
Subject: BUG/MINOR: sample: Fix wrong 'base64urldec' return value check in 'jwt_member_query'
X-Git-Tag: v3.5-dev10~116
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=1edbb7b83d9b09ff4d6b0e37d951f237a9517810;p=haproxy.git

BUG/MINOR: sample: Fix wrong 'base64urldec' return value check in 'jwt_member_query'

The 'base64urldec' function return value was only checked against -1
when it can also return -2 in case of error (too small out buffer).

This was raised in GitHub issue #3510.
This patch can be backported to all stable branches.
---

diff --git a/src/sample.c b/src/sample.c
index c34f143a8..7f2a93df6 100644
--- a/src/sample.c
+++ b/src/sample.c
@@ -5072,7 +5072,7 @@ static int sample_conv_jwt_member_query(const struct arg *args, struct sample *s
 
 	ret = base64urldec(items[member].start, items[member].length,
 	                   decoded_header->area, decoded_header->size);
-	if (ret == -1)
+	if (ret < 0)
 		goto end;
 
 	/* mjson might return an embedded \0 that is not valid as a string */