[PATCH 1/3] Use timingsafe_memcmp() to compare MIT-MAGIC-COOKIES CVE-2017-2624

[Hans de Goede]

Hi,

On 28-02-17 23:52, Matthieu Herrb wrote:
>
> On Tue, Feb 28, 2017 at 10:41:29PM +0000, Emil Velikov wrote:
>> Hi Matthieu,
>>
>> On 28 February 2017 at 18:18, Matthieu Herrb <matthieu at herrb.eu> wrote:
>>> Provide the function definition for systems that don't have it.
>>>
>>> Signed-off-by: Matthieu Herrb <matthieu at herrb.eu>
>>> Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
>>> ---
>>>  configure.ac            |  3 ++-
>>>  include/dix-config.h.in |  3 +++
>>>  include/os.h            |  5 +++++
>>>  os/mitauth.c            |  2 +-
>>>  os/timingsafe_memcmp.c  | 45 +++++++++++++++++++++++++++++++++++++++++++++
>>>  5 files changed, 56 insertions(+), 2 deletions(-)
>>
>>> --- /dev/null
>>> +++ b/os/timingsafe_memcmp.c
>> Shouldn't we add this new file to Makefile.am somewhere ?
>
> Hi,
>
> No; AC_REPLACE_FUNCS() takes completely care of it.
>
> In os/Makefile.am you have :
>
> libos_la_LIBADD = @SHA1_LIBS@ $(DLOPEN_LIBS) $(LTLIBOBJS)
>
> and LTLIBOBJS is expanded to the list of filenames corresponding to
> functions that need to be provided in the AC_REPLACE_FUNC() macro.

What about make dist for making the source tarbals ?

Regards,

Hans