cfg/provider: use oidc_jwk_list_copy when merging client_keys

Signed-off-by: Hans Zandbelt <[email protected]>
OpenIDC · Jul 3, 2024 · 9c0909a · 9c0909a
1 parent 30d9a55
commit 9c0909a
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,6 @@
+07/03/2024
+- cfg/provider: use oidc_jwk_list_copy when merging client_keys
+
 06/18/2024
 - memcache: correct dead server check on APR_NOTFOUND; see #1230; thanks @rpluem-vf
 

diff --git a/src/cfg/provider.c b/src/cfg/provider.c
@@ -759,7 +759,7 @@ void oidc_cfg_provider_merge(apr_pool_t *pool, oidc_provider_t *dst, const oidc_
 	dst->dpop_mode = add->dpop_mode != OIDC_CONFIG_POS_INT_UNSET ? add->dpop_mode : base->dpop_mode;
 
 	dst->client_jwks_uri = add->client_jwks_uri != NULL ? add->client_jwks_uri : base->client_jwks_uri;
-	dst->client_keys = add->client_keys != NULL ? add->client_keys : base->client_keys;
+	dst->client_keys = oidc_jwk_list_copy(pool, add->client_keys != NULL ? add->client_keys : base->client_keys);
 
 	dst->id_token_signed_response_alg = add->id_token_signed_response_alg != NULL
 						? add->id_token_signed_response_alg