[xmlsec] HMACOutputLength bug?

Rich Salz rsalz at datapower.com
Fri Jan 24 08:47:37 PST 2003

We tried an interop test (against our product) with a length of 91 and 
it failed.  The bug seems to be that xmlsec rounds down to the nearest 
         if(content != NULL) {
             res = atoi((char*)content) / 8;
The fix looks a little tricky, since changing "digestSize" from bytes to 
  bits would be pretty pervasive.  Perhaps adding a "outputBits" field 
which, if non-zero, is used as a mask?

More information about the xmlsec mailing list