CVE-2022-48566 Cherry-pick 8bef9ebb1b88cfa4b2a38b93fe4ea22015d8254a #44
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bpo-40791: Make compare_digest more constant-time. (pythonGH-23438) (pythonGH-23767) The existing volatile `left`/`right` pointers guarantee that the reads will all occur, but does not guarantee that they will be _used_. So a compiler can still short-circuit the loop, saving e.g. the overhead of doing the xors and especially the overhead of the data dependency between `result` and the reads. That would change performance depending on where the first unequal byte occurs. This change removes that optimization. (This is change GH-1 from https://bugs.python.org/issue40791 .) (cherry picked from commit 3172936) Co-authored-by: Devin Jeanpierre <[email protected]> (cherry picked from commit 8bef9eb)
Author
|
The original fix for Python 3.6, and Python3.7 don't seem to include any tests for this. |
icanhasmath
approved these changes
Apr 17, 2024
icanhasmath
left a comment
icanhasmath
left a comment
There was a problem hiding this comment.
Looks good - this is what they say.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
bpo-40791: Make compare_digest more constant-time. (pythonGH-23438) (pythonGH-23767)
The existing volatile
left/rightpointers guarantee that the reads will all occur, but does not guarantee that they will be used. So a compiler can still short-circuit the loop, saving e.g. the overhead of doing the xors and especially the overhead of the data dependency betweenresultand the reads. That would change performance depending on where the first unequal byte occurs. This change removes that optimization.(This is change GH-1 from https://bugs.python.org/issue40791 .)
(cherry picked from commit 3172936)
(cherry picked from commit 8bef9eb)