>From a9e593c8ee498443a2a260382945c49e14c424cc Mon Sep 17 00:00:00 2001
From: Jakob Kramer <jakob.kra...@gmx.de>
Date: Wed, 30 Apr 2014 00:20:31 +0200
Subject: [PATCH 2/2] su: use "constant time" memcmp to compare password
---
su.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/su.c b/su.c
index 16ce6c2..54d7679 100644
--- a/su.c
+++ b/su.c
@@ -17,6 +17,7 @@ extern char **environ;
static const char *randreply(void);
static char *msetenv(const char *, const char *);
static void dologin(struct passwd *);
+static int passcmp(const char *, const char *, size_t);
static void
usage(void)
@@ -86,7 +87,7 @@ main(int argc, char *argv[])
if (!cryptpass)
eprintf("crypt:");
- if (strcmp(cryptpass, spw->sp_pwdp) != 0)
+ if (passcmp(cryptpass, spw->sp_pwdp, strlen(cryptpass)) != 0)
eprintf(randreply());
for (i = 0; cryptpass[i]; i++)
@@ -187,3 +188,15 @@ dologin(struct passwd *pw)
eprintf("chdir %s:", pw->pw_dir);
execve(pw->pw_shell, newargv, newenv);
}
+
+static int
+passcmp(const char *s, const char *t, size_t n)
+{
+ size_t i;
+ char d = 0;
+
+ for (i = 0; i < n; i++)
+ d |= s[i] ^ t[i];
+
+ return d;
+}
--
1.8.5.1
