From 741e8534323f6b7eb5565f8ec09ab2731e52735b Mon Sep 17 00:00:00 2001 From: Noriko Hosoi Date: Thu, 4 Aug 2016 13:26:44 -0700 Subject: [PATCH] Ticket bz1358565 - clear and unsalted password types are vulnerable to timing attack Description: Build fails with the commit f0e03b5a51972a125fe78f448d1f68e288782d1e: error: 'for' loop initial declarations are only allowed in C99 mode for (size_t i = 0; i < n; i++) { ^ Moved "size_t i;" to the top of slapi_ct_memcmp. --- ldap/servers/slapd/ch_malloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ldap/servers/slapd/ch_malloc.c b/ldap/servers/slapd/ch_malloc.c index a38268c..705ea86 100644 --- a/ldap/servers/slapd/ch_malloc.c +++ b/ldap/servers/slapd/ch_malloc.c @@ -374,12 +374,13 @@ slapi_ct_memcmp( const void *p1, const void *p2, size_t n) int result = 0; const unsigned char *_p1 = (const unsigned char *)p1; const unsigned char *_p2 = (const unsigned char *)p2; + size_t i; if (_p1 == NULL || _p2 == NULL) { return 2; } - for (size_t i = 0; i < n; i++) { + for (i = 0; i < n; i++) { if (_p1[i] ^ _p2[i]) { result = 1; } -- 2.4.11