mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-01-09 17:38:00 +00:00
Make smemeq return unsigned, not bool.
bool is dangerous in a time-safe context, because C compilers might insert a control flow divergence to implement the implicit normalisation of nonzero integers to 1 when you assign to a bool. Everywhere else time-safe, I avoid using it; but smemeq has been an exception until now, because the response to smemeq returning failure was to do an obvious protocol-level divergence _anyway_ (like disconnecting due to MAC mismatch). But I'm about to want to use smemeq in a context where I use the result _subtly_ and don't want to give away what it is, so now it's time to get rid of that bool and have smemeq return unsigned.
This commit is contained in:
parent
d5af33da53
commit
31db2e67bb
6
misc.h
6
misc.h
@ -207,9 +207,9 @@ void smemclr(void *b, size_t len);
|
||||
/* Compare two fixed-length chunks of memory for equality, without
|
||||
* data-dependent control flow (so an attacker with a very accurate
|
||||
* stopwatch can't try to guess where the first mismatching byte was).
|
||||
* Returns false for mismatch or true for equality (unlike memcmp),
|
||||
* hinted at by the 'eq' in the name. */
|
||||
bool smemeq(const void *av, const void *bv, size_t len);
|
||||
* Returns 0 for mismatch or 1 for equality (unlike memcmp), hinted at
|
||||
* by the 'eq' in the name. */
|
||||
unsigned smemeq(const void *av, const void *bv, size_t len);
|
||||
|
||||
/* Encode a single UTF-8 character. Assumes that illegal characters
|
||||
* (such as things in the surrogate range, or > 0x10FFFF) have already
|
||||
|
@ -8,7 +8,7 @@
|
||||
#include "defs.h"
|
||||
#include "misc.h"
|
||||
|
||||
bool smemeq(const void *av, const void *bv, size_t len)
|
||||
unsigned smemeq(const void *av, const void *bv, size_t len)
|
||||
{
|
||||
const unsigned char *a = (const unsigned char *)av;
|
||||
const unsigned char *b = (const unsigned char *)bv;
|
||||
|
Loading…
Reference in New Issue
Block a user