URL:
https://github.com/SSSD/sssd/pull/58
Title: #58: Fix bug in libcrypto version of sss_decrypt
tiran commented:
"""
I cannot recall that I reviewed the code. In fact I didn't even know that OpenSSL had
a constant timing comparison operator called ```CRYPTO_memcmp```. @lslebodn fix looks
right.
While I was searching for documentation of ```CRYPTO_memcmp```, one posting suggested that
optimizers such as PGO or LTO might replace ```CRYPTO_memcmp``` with inline assembler for
```memcmp```. The author suggested to make one of the arguments ```volatile```.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/58#issuecomment-255329314