From dbc28840967624c1099c44a3a8e74078feffac5a Mon Sep 17 00:00:00 2001 From: Pavel Punsky Date: Sat, 18 Apr 2026 17:08:46 -0700 Subject: [PATCH] Use constant-time compare for STUN MESSAGE-INTEGRITY HMAC (#1869) memcmp short-circuits on first differing byte, letting an attacker recover a valid HMAC byte-by-byte via response-time differences. Switch to CRYPTO_memcmp, which is constant-time regardless of the first mismatching byte. --- src/client/ns_turn_msg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/client/ns_turn_msg.c b/src/client/ns_turn_msg.c index 9ff66302..028ef601 100644 --- a/src/client/ns_turn_msg.c +++ b/src/client/ns_turn_msg.c @@ -1931,7 +1931,9 @@ int stun_check_message_integrity_by_key_str(turn_credential_type ct, uint8_t *bu return -1; } - if (0 != memcmp(old_hmac, new_hmac, shasize)) { + /* Use constant-time comparison: a short-circuiting memcmp leaks the matching prefix + length via response timing, allowing byte-by-byte HMAC recovery. */ + if (0 != CRYPTO_memcmp(old_hmac, new_hmac, shasize)) { return 0; }