agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Add timingsafe_bcmp(), for constant-time memory comparison 5+ messages / 2 participants [nested] [flat]
* pgsql: Add timingsafe_bcmp(), for constant-time memory comparison @ 2025-04-02 12:42 Heikki Linnakangas <heikki.linnakangas@iki.fi> 0 siblings, 0 replies; 5+ messages in thread From: Heikki Linnakangas @ 2025-04-02 12:42 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add timingsafe_bcmp(), for constant-time memory comparison timingsafe_bcmp() should be used instead of memcmp() or a naive for-loop, when comparing passwords or secret tokens, to avoid leaking information about the secret token by timing. This commit just introduces the function but does not change any existing code to use it yet. Co-authored-by: Jelte Fennema-Nio <github-tech@jeltef.nl> Discussion: https://www.postgresql.org/message-id/7b86da3b-9356-4e50-aa1b-56570825e234@iki.fi Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/09be39112654c3f158098fdb5f820143c0330763 Modified Files -------------- configure | 23 +++++++++++++++++++++++ configure.ac | 3 ++- meson.build | 2 ++ src/include/port.h | 4 ++++ src/port/meson.build | 1 + src/port/timingsafe_bcmp.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 75 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Add timingsafe_bcmp(), for constant-time memory comparison @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add timingsafe_bcmp(), for constant-time memory comparison timingsafe_bcmp() should be used instead of memcmp() or a naive for-loop, when comparing passwords or secret tokens, to avoid leaking information about the secret token by timing. This commit just introduces the function but does not change any existing code to use it yet. This has been initially applied as of 09be39112654 in v18 and newer versions, and will be used in all the stable branches for an upcoming fix. Co-authored-by: Jelte Fennema-Nio <github-tech@jeltef.nl> Discussion: https://www.postgresql.org/message-id/7b86da3b-9356-4e50-aa1b-56570825e234@iki.fi Security: CVE-2026-6478 Backpatch-through: 14 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/8e34acfda11595fdf2b1cfa96dc6949c34d34cd7 Author: Heikki Linnakangas <heikki.linnakangas@iki.fi> Modified Files -------------- configure | 23 +++++++++++++++++++++++ configure.ac | 3 ++- meson.build | 2 ++ src/include/pg_config.h.in | 7 +++++++ src/include/port.h | 4 ++++ src/port/meson.build | 1 + src/port/timingsafe_bcmp.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 82 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Add timingsafe_bcmp(), for constant-time memory comparison @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add timingsafe_bcmp(), for constant-time memory comparison timingsafe_bcmp() should be used instead of memcmp() or a naive for-loop, when comparing passwords or secret tokens, to avoid leaking information about the secret token by timing. This commit just introduces the function but does not change any existing code to use it yet. This has been initially applied as of 09be39112654 in v18 and newer versions, and will be used in all the stable branches for an upcoming fix. Co-authored-by: Jelte Fennema-Nio <github-tech@jeltef.nl> Discussion: https://www.postgresql.org/message-id/7b86da3b-9356-4e50-aa1b-56570825e234@iki.fi Security: CVE-2026-6478 Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/1604939b2210b93e34572ee6df499d103849c53e Author: Heikki Linnakangas <heikki.linnakangas@iki.fi> Modified Files -------------- configure | 23 +++++++++++++++++++++++ configure.ac | 3 ++- meson.build | 2 ++ src/include/pg_config.h.in | 7 +++++++ src/include/port.h | 4 ++++ src/port/meson.build | 1 + src/port/timingsafe_bcmp.c | 43 +++++++++++++++++++++++++++++++++++++++++++ src/tools/msvc/Mkvcbuild.pm | 2 +- src/tools/msvc/Solution.pm | 2 ++ 9 files changed, 85 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Add timingsafe_bcmp(), for constant-time memory comparison @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add timingsafe_bcmp(), for constant-time memory comparison timingsafe_bcmp() should be used instead of memcmp() or a naive for-loop, when comparing passwords or secret tokens, to avoid leaking information about the secret token by timing. This commit just introduces the function but does not change any existing code to use it yet. This has been initially applied as of 09be39112654 in v18 and newer versions, and will be used in all the stable branches for an upcoming fix. Co-authored-by: Jelte Fennema-Nio <github-tech@jeltef.nl> Discussion: https://www.postgresql.org/message-id/7b86da3b-9356-4e50-aa1b-56570825e234@iki.fi Security: CVE-2026-6478 Backpatch-through: 14 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/9dcfcb92fff82b398f2ba0c03eb7bea9c197aab2 Author: Heikki Linnakangas <heikki.linnakangas@iki.fi> Modified Files -------------- configure | 23 +++++++++++++++++++++++ configure.ac | 3 ++- src/include/pg_config.h.in | 7 +++++++ src/include/port.h | 4 ++++ src/port/timingsafe_bcmp.c | 43 +++++++++++++++++++++++++++++++++++++++++++ src/tools/msvc/Mkvcbuild.pm | 2 +- src/tools/msvc/Solution.pm | 2 ++ 7 files changed, 82 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Add timingsafe_bcmp(), for constant-time memory comparison @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add timingsafe_bcmp(), for constant-time memory comparison timingsafe_bcmp() should be used instead of memcmp() or a naive for-loop, when comparing passwords or secret tokens, to avoid leaking information about the secret token by timing. This commit just introduces the function but does not change any existing code to use it yet. This has been initially applied as of 09be39112654 in v18 and newer versions, and will be used in all the stable branches for an upcoming fix. Co-authored-by: Jelte Fennema-Nio <github-tech@jeltef.nl> Discussion: https://www.postgresql.org/message-id/7b86da3b-9356-4e50-aa1b-56570825e234@iki.fi Security: CVE-2026-6478 Backpatch-through: 14 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/b282280e9b69cae988c0c69cce3eda4d4bd38fff Author: Heikki Linnakangas <heikki.linnakangas@iki.fi> Modified Files -------------- configure | 23 +++++++++++++++++++++++ configure.ac | 3 ++- src/include/pg_config.h.in | 7 +++++++ src/include/port.h | 4 ++++ src/port/timingsafe_bcmp.c | 43 +++++++++++++++++++++++++++++++++++++++++++ src/tools/msvc/Mkvcbuild.pm | 2 +- src/tools/msvc/Solution.pm | 2 ++ 7 files changed, 82 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2026-05-11 12:19 UTC | newest] Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2025-04-02 12:42 pgsql: Add timingsafe_bcmp(), for constant-time memory comparison Heikki Linnakangas <heikki.linnakangas@iki.fi> 2026-05-11 12:19 pgsql: Add timingsafe_bcmp(), for constant-time memory comparison Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Add timingsafe_bcmp(), for constant-time memory comparison Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Add timingsafe_bcmp(), for constant-time memory comparison Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Add timingsafe_bcmp(), for constant-time memory comparison Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox