From 640b5d372f77bec563469acb24e8606ac29b5fa6 Mon Sep 17 00:00:00 2001
From: Michael Ortmann <ortmann@posteo.de>
Date: Sat, 20 Jun 2026 06:07:03 +0200
Subject: [PATCH 1/2] More time constant string comparisions for passwords

---
 src/dcc.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/dcc.c b/src/dcc.c
index ffee55230..f18a4e16f 100644
--- a/src/dcc.c
+++ b/src/dcc.c
@@ -360,14 +360,14 @@ static char *get_bot_pass(struct userrec *u) {
       if (!pass) {
         pass = pass2;
         if (encrypt_pass) {
-	  /* get_user() returns a pointer of struct user_entry
+          /* get_user() returns a pointer of struct user_entry
            * and set_user()->pass2_set() could free() and realloc it
-	   * so fetch it again with get_user()
-	   */
+           * so fetch it again with get_user()
+           */
           set_user(&USERENTRY_PASS, u, pass);
           pass = get_user(&USERENTRY_PASS2, u);
-	}
-      } else if (strcmp(pass2, pass) && encrypt_pass2)
+        }
+      } else if (crypto_verify(pass2, pass) && encrypt_pass2)
         pass = pass2;
     } else if (pass && encrypt_pass2)
         set_user(&USERENTRY_PASS2, u, pass);
@@ -396,7 +396,7 @@ static void dcc_bot_new(int idx, char *buf, int x)
     putlog(LOG_BOTS, "*", DCC_BADPASS, dcc[idx].nick);
   else if (!strcasecmp(code, "passreq")) {
     pass = get_bot_pass(u);
-    if (!pass || !strcmp(pass, "-")) {
+    if (!pass || !crypto_verify(pass, "-")) {
       putlog(LOG_BOTS, "*", DCC_PASSREQ, dcc[idx].nick);
       dprintf(idx, "-\n");
     } else {

From 354cc3dfeeffe89dbf70d0a27b1c8225b416b953 Mon Sep 17 00:00:00 2001
From: Michael Ortmann <ortmann@posteo.de>
Date: Sat, 20 Jun 2026 06:12:11 +0200
Subject: [PATCH 2/2] Dont need this one

---
 src/dcc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/dcc.c b/src/dcc.c
index f18a4e16f..7c76d29c2 100644
--- a/src/dcc.c
+++ b/src/dcc.c
@@ -396,7 +396,7 @@ static void dcc_bot_new(int idx, char *buf, int x)
     putlog(LOG_BOTS, "*", DCC_BADPASS, dcc[idx].nick);
   else if (!strcasecmp(code, "passreq")) {
     pass = get_bot_pass(u);
-    if (!pass || !crypto_verify(pass, "-")) {
+    if (!pass || !strcmp(pass, "-")) {
       putlog(LOG_BOTS, "*", DCC_PASSREQ, dcc[idx].nick);
       dprintf(idx, "-\n");
     } else {