Eric Covener e66cbabeda Merge r1933389 from trunk: ...

Add ap_*_timingsafe() constant-time comparison functions:

* include/httpd.h: Declare ap_memeq_timingsafe(), ap_streq_timingsafe(), ap_strneq_timingsafe().

* server/util.c: Implement, wrapping apr_*_timingsafe() if APR >= 1.8, with a fallback to copied-in versions.

* modules/aaa/mod_auth_digest.c: Replace apr_crypto_equals() with ap_memeq_timingsafe(). Remove apr_crypto.h include.

* modules/session/mod_session_crypto.c: Replace local ap_crypto_equals() with ap_memeq_timingsafe(). Remove the local implementation and macro alias.

* include/ap_mmn.h: Bump MMN minor.

Submitted by:  jorton
Reviewed by: jorton, rpluem, covener

Github: closes #639


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933444 13f79535-47bb-0310-9956-ffa450edef68

2026-04-28 18:10:32 +00:00

..

workflows

Merge r1933389 from trunk:

2026-04-28 18:10:32 +00:00