Khem Raj f0d0a6b626 cjose: Fix build with clang by initializing decoded buffer lengths ...

_cjose_jwk_import_RSA() and _cjose_jwk_import_EC() declare their
*_buflen variables in the middle of the function, interleaved with error
paths that goto a shared cleanup label. An early decode failure jumps
over the remaining declarations, and the cleanup block then reads them
uninitialized:

| jwk.c:1501:9: error: variable 'dq_buflen' is used uninitialized
|                whenever 'if' condition is true
|                [-Werror,-Wsometimes-uninitialized]
| jwk.c:1554:39: note: uninitialized use occurs here
|     _cjose_cleanse_dealloc(dq_buffer, dq_buflen);

_cjose_cleanse_dealloc() uses the length to wipe key material, so this
is an out-of-bounds write hazard on the error path rather than just a
warning. src/Makefile.am builds with -Werror, so clang also makes it
fatal; the 0.6.2.4 -> 0.6.2.7 upgrade exposed it.

Verified on aarch64 for qemuarm64: do_compile fails before the change
with 20 such errors, and do_compile and do_package succeed after.

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

2026-08-06 23:32:43 -07:00

..

cjose

cjose: Fix build with clang by initializing decoded buffer lengths

2026-08-06 23:32:43 -07:00

cjose_0.6.2.7.bb

cjose: Fix build with clang by initializing decoded buffer lengths

2026-08-06 23:32:43 -07:00