Graham Sutherland / Polynomialbug of the day: a memcmp that only compares every fourth byte
gaytabase@dysfun it's a constant time implementation if that helps
@dysfun essentially this:
int memcmp32(uint32_t* a, uint32_t* b, int words)
{
uint8_t sum = 0; // whoops
while(words--) {
sum |= *a++ ^ *b++;
}
return sum;
}
@gsuberland yes, that's exactly what i thought
@dysfun ehehehe
the code in question lucked out by never actually using it in a path that matters, but it's in a core lib for something security sensitive so easily could've ended up being bad
@gsuberland yeah it lucked out by not having bit rotted yet