mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-12-27 06:14:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

ppp: use constant-time memcmp for checking credentials

Browse Source 
See #65119
This commit is contained in:
Simon Goldschmidt 2024-01-09 21:23:11 +01:00
parent 25de99d1c1
commit c167a54540
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/netif/ppp/auth.c
View File

@ -1012,8 +1012,8 @@ int auth_check_passwd(ppp_pcb *pcb, char *auser, unsigned int userlen, char *apa
secretpasswdlen = strlen(pcb->settings.passwd); secretpasswdlen = strlen(pcb->settings.passwd);
if (secretuserlen == userlen if (secretuserlen == userlen
&& secretpasswdlen == passwdlen && secretpasswdlen == passwdlen
&& !memcmp(auser, pcb->settings.user, userlen) && !lwip_memcmp_consttime(auser, pcb->settings.user, userlen)
&& !memcmp(apasswd, pcb->settings.passwd, passwdlen) ) { && !lwip_memcmp_consttime(apasswd, pcb->settings.passwd, passwdlen) ) {
*msg = "Login ok"; *msg = "Login ok";
*msglen = sizeof("Login ok")-1; *msglen = sizeof("Login ok")-1;
return 1; return 1;