oidc_jwk_list_destroy_hash segfault since v2.4.6

[bommo1]

until 2.4.5 it works. 2.4.6 - 2.4.12.2 segfault

oidc_jwk_list_destroy_hash -> apr_hash_first -> apr_hash_next -> segfault on line hi->this = hi->ht->array[hi->index++];

Apache 2.4.55.

Config:

OIDCOAuthAcceptTokenAs header
OIDCOAuthVerifyCertFiles kid#/file.pem
OIDCAuthNHeader X-Forwarded-User
OIDCOAuthRemoteUserClaim preferred_username

Probably from this commit: 2019f54

[zandbelt]

I think it was just fixed in 203b764 can you confirm?

[bommo1]

Thank you for the quick response!
We have 2 VirtualHosts each with only one cert in OIDCOAuthVerifyCertFiles.
I cannot quickly build from source at this point. I'll test and confirm when the new version is released.

[zandbelt]

for which platform you'd need a build to quickly test?

[bommo1]

AlmaLinux 8.6 x86_64

[zandbelt]

please try https://www.mod-auth-openidc.org/downloads/mod_auth_openidc-2.4.12.3rc0-1.el8.x86_64.rpm

[bommo1]

I confirm that the problem is fixed in this build. Thank you!

[zandbelt]

now published as part of release 2.4.12.3, see: https://github.com/zmartzone/mod_auth_openidc/releases/tag/2.4.12.3