adafruit-mirror/lwip
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ppp: use constant-time memcmp for checking credentials

Browse source 
See #65119
This commit is contained in:
Simon Goldschmidt 2024-01-09 21:23:11 +01:00
parent 25de99d1c1
commit c167a54540
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/netif/ppp/auth.c
View file

@ -1012,8 +1012,8 @@ int auth_check_passwd(ppp_pcb *pcb, char *auser, unsigned int userlen, char *apa
secretpasswdlen = strlen(pcb->settings.passwd);
if (secretuserlen == userlen
&& secretpasswdlen == passwdlen
&& !memcmp(auser, pcb->settings.user, userlen)
&& !memcmp(apasswd, pcb->settings.passwd, passwdlen) ) {
&& !lwip_memcmp_consttime(auser, pcb->settings.user, userlen)
&& !lwip_memcmp_consttime(apasswd, pcb->settings.passwd, passwdlen) ) {
*msg = "Login ok";
*msglen = sizeof("Login ok")-1;
return 1;