squidy/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent.git synced 2025-12-29 11:48:05 -06:00
Code Issues Packages Projects Releases Wiki Activity

WEBUI: Protect against timing attacks. Closes #2108.

Browse Source
This commit is contained in:
sledgehammer999
2014-11-02 21:19:27 +02:00
parent 09ab5c37ce
commit 6f14b34470
3 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/misc.cpp
View File

@@ -645,6 +645,20 @@ QString misc::accurateDoubleToString(const double &n, const int &precision, bool
return QString::number(std::floor(n*prec)/prec, 'f', precision);
}
// Implements constant-time comparison to protect against timing attacks
// Taken from https://crackstation.net/hashing-security.htm
bool misc::slowEquals(const QByteArray &a, const QByteArray &b)
{
int lengthA = a.length();
int lengthB = b.length();
int diff = lengthA ^ lengthB;
for(int i = 0; i < lengthA && i < lengthB; i++)
diff |= a[i] ^ b[i];
return (diff == 0);
}
namespace {
// Trick to get a portable sleep() function
class SleeperThread : public QThread {