in jwe.c, on line 1952: ``` cek = cjose_get_alloc()(cek_len); memcpy(cek, jwe->cek, cek_len); ``` Allocation result is not checked. We should add ``` if (!cek) { CJOSE_ERROR(err, CJOSE_ERR_NO_MEMORY); return NULL; } ```