From cb04e9cbd5f9280ff0616a58967c87493732bd6f Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Sun, 17 May 2026 11:26:53 +0500 Subject: [PATCH] engine: server: also use constant time string comparison for sv_password --- engine/server/sv_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/engine/server/sv_client.c b/engine/server/sv_client.c index 099aa219..7639f24d 100644 --- a/engine/server/sv_client.c +++ b/engine/server/sv_client.c @@ -361,7 +361,7 @@ static void SV_ConnectClient( netadr_t from ) // check connection password (don't verify local client) if( !NET_IsLocalAddress( from ) && SV_HavePassword( )) { - if( Q_stricmp( sv_password.string, Info_ValueForKey( userinfo, "password" ))) + if( Q_strcmp_constant_time( sv_password.string, Info_ValueForKey( userinfo, "password" ))) { SV_RejectConnection( from, "invalid password\n" ); return;