1 files changed, 6 insertions, 4 deletions

diff --git a/lib/basic_rp.cc b/lib/basic_rp.cc
index bd45d99..a0ad130 100644
--- a/lib/basic_rp.cc
+++ b/lib/basic_rp.cc
@@ -1,2 +1,3 @@
+#include <cassert>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
@@ -26,5 +27,6 @@ namespace opkele {
         if(cklen && (*ckptr)&0x80) {
             (*(--ckptr))=0; ++cklen; }
-        unsigned char key_digest[d_len];
+        assert(d_len<=SHA256_DIGEST_LENGTH);
+        unsigned char key_digest[SHA256_DIGEST_LENGTH];
         secret.enxor_from_base64((*d_fun)(ckptr,cklen,key_digest),om.get_field("enc_mac_key"));
         if(secret.size()!=exp_s_len)
@@ -79,5 +81,5 @@ namespace opkele {
                     dh, SHA256_DIGEST_LENGTH, SHA256, SHA256_DIGEST_LENGTH );
             expires_in = util::string_to_long(res.get_field("expires_in"));
-        }catch(exception& e) {
+        }catch(exception&) {
             try {
                 req.set_field("assoc_type","HMAC-SHA1");
@@ -88,5 +90,5 @@ namespace opkele {
                         dh, SHA_DIGEST_LENGTH, SHA1, SHA_DIGEST_LENGTH );
                 expires_in = util::string_to_long(res.get_field("expires_in"));
-            }catch(bad_input& e) {
+            }catch(bad_input&) {
                 throw dumb_RP(OPKELE_CP_ "OP failed to supply an association");
             }
@@ -235,5 +237,5 @@ namespace opkele {
                 "op_endpoint", "return_to", "response_nonce", "assoc_handle",
                 "claimed_id", "identity" };
-            for(int ms=0;ms<(sizeof(mustsign)/sizeof(*mustsign));++ms) {
+            for(size_t ms=0;ms<(sizeof(mustsign)/sizeof(*mustsign));++ms) {
                 if(om.has_field(mustsign[ms]) && !signeds.has_field(mustsign[ms]))
                     throw bad_input(OPKELE_CP_ string("Field '")+mustsign[ms]+"' is not signed against the specs");