From 391f3c418b09489caee3ffb32935e18a4dfb03b3 Mon Sep 17 00:00:00 2001 From: arshiya tabasum Date: Tue, 11 Aug 2026 18:38:28 +0530 Subject: [PATCH] fix off-by-one buffer over-read in autht_jwt check_token --- modules/aaa/mod_autht_jwt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/aaa/mod_autht_jwt.c b/modules/aaa/mod_autht_jwt.c index dedddece303..617344dfdd7 100644 --- a/modules/aaa/mod_autht_jwt.c +++ b/modules/aaa/mod_autht_jwt.c @@ -1051,7 +1051,7 @@ static autht_status check_token(request_rec *r, const char *type, } key = apr_psprintf(r->pool, AUTHT_PREFIX "%.*s", (int)kv->k->value.string.len, kv->k->value.string.p); - j = sizeof(AUTHT_PREFIX); + j = sizeof(AUTHT_PREFIX) - 1; /* string length of "TOKEN_", excluding the trailing NUL */ while (key[j]) { if (apr_isalnum(key[j])) { key[j] = apr_toupper(key[j]);