CVE-2022-26691: An incorrect comparison in local admin authentication

apple · May 25, 2022 · 0bc9dc4 · 0bc9dc4
1 parent 696f74a
commit 0bc9dc4
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/scheduler/cert.c b/scheduler/cert.c
@@ -434,5 +434,9 @@ ctcompare(const char *a, /* I - First string */
  b ++;
  }
 
+ // either both *a and *b == '\0', or one points inside a string,
+ // so factor that in.
+ result |= (*a ^ *b);
+
  return (result);
 }