Fixed: smart_str_free() bug

Author: cdoco

jwt.c

@@ -630,9 +630,8 @@ static void php_jwt_decode(INTERNAL_FUNCTION_PARAMETERS) {
 
         if (jwt_verify(jwt, sig)) {
             zend_throw_exception(jwt_signature_invalid_cex, "Signature verification failed", 0);
+            goto decode_done;
         }
-
-        smart_str_free(&buf);
     }
 
     /* verify body */
@@ -643,6 +642,7 @@ static void php_jwt_decode(INTERNAL_FUNCTION_PARAMETERS) {
 decode_done:
     efree(head);
     jwt_free(jwt);
+    smart_str_free(&buf);
 }
 
 /* function jwt_encode() */

tests/015.phpt

@@ -8,7 +8,7 @@ $hmackey = "example-hmac-key";
 
 try {
     $decoded_token = jwt_decode('eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7Im5hbWUiOiJaaUhhbmcgR2FvIiwiYWRtaW4iOnRydWV9LCJzdWIiOiIxMjM0NTY3ODkwIiwibmJmIjoxNTQ2ODQ4CJhdWQiOiJ5eSJ9.fDqiF-cCIvlcscIdz7dcFJoYGBcvHtI6MWB5IWG0VHA', $hmackey, ['algorithm' => 'HS256']);
-} catch (UnexpectedValueException $e) {
+} catch (SignatureInvalidException $e) {
      // Handle expired token
      echo "FAIL\n";
 }