<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p class="details" style="font-style: italic; color: #777;">
<a href="https://gitlab.com/dueno">Daiki Ueno</a> created a merge request:
</p>
<p>
</p>
<div class="branch">
Branches: tmp-safe-memcmp to master
</div>
<div class="author">
Author: Daiki Ueno
</div>
<div class="assignee">
Assignees:
</div>
<div class="approvers">
</div>
<div>
<p dir="auto">This replaces the uses of <code>safe_memcmp</code> with <code>gnutls_memcmp</code> which is resilient against timing attacks. Note that this doesn't imply that the previous code was vulnerable: they were either (1) both arguments are public or (2) both arguments are confidential (and thus the attacker is not able to leverage it for timing attacks unless it has access to the data already).</p>
<p dir="auto">Fixes #1042.</p>
<h2 dir="auto">
<a id="user-content-checklist" class="anchor" href="#checklist" aria-hidden="true"></a>Checklist</h2>
<ul class="task-list" dir="auto">
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" checked disabled> Commits have <code>Signed-off-by:</code> with name/author being identical to the commit author</li>
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> Code modified for feature</li>
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> Test suite updated with functionality tests</li>
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> Test suite updated with negative tests</li>
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> Documentation updated / NEWS entry present (for non-trivial changes)</li>
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> CI timeout is 2h or higher (see Settings/CICD/General pipelines/Timeout)</li>
</ul>
<h2 dir="auto">
<a id="user-content-reviewers-checklist" class="anchor" href="#reviewers-checklist" aria-hidden="true"></a>Reviewer's checklist:</h2>
<ul class="task-list" dir="auto">
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> Any issues marked for closing are addressed</li>
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> There is a test suite reasonably covering new functionality or modifications</li>
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> Function naming, parameters, return values, types, etc., are consistent and according to <code>CONTRIBUTION.md</code>
</li>
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> This feature/change has adequate documentation added</li>
<li class="task-list-item">
<input type="checkbox" class="task-list-item-checkbox" disabled> No obvious mistakes in the code</li>
</ul>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/merge_requests/1297">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/-/sent_notifications/4b5d279346c953b72c03c34c25e8dd9f/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Merge request","url":"https://gitlab.com/gnutls/gnutls/-/merge_requests/1297"}}</script>
</p>
</div>
</body>
</html>