From 9adbea95678979c005dab49143d80bad80641d71 Mon Sep 17 00:00:00 2001 From: Adam Chlipala Date: Tue, 19 Jul 2011 09:18:50 -0400 Subject: Change cookie signature comparison to resist timing attacks (based on code suggested by Robin Green and Austin Seipp) --- src/cjr_print.sml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/cjr_print.sml') diff --git a/src/cjr_print.sml b/src/cjr_print.sml index 79d7e7da..340ac9f5 100644 --- a/src/cjr_print.sml +++ b/src/cjr_print.sml @@ -2634,7 +2634,7 @@ fun p_file env (ds, ps) = newline, string "if (sig == NULL) uw_error(ctx, FATAL, \"Missing cookie signature\");", newline, - string "if (strcmp(sig, uw_cookie_sig(ctx)))", + string "if (!uw_streq(sig, uw_cookie_sig(ctx)))", newline, box [string "uw_error(ctx, FATAL, \"Wrong cookie signature\");", newline], -- cgit v1.2.3