This mention of memcpy() should of course have said memcmp().
Reported-by: chris@chrullrich.net
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/
177883653690.764749.
14038057906859461991@wrigleys.postgresql.org
Backpatch-through: 14
<para>
Use <function>timingsafe_bcmp()</function> instead
- of <function>memcpy()</function> or <function>strcmp()</function>
+ of <function>memcmp()</function> or <function>strcmp()</function>
when checking passwords, hashes, etc. It is not known whether the
data dependency of those functions is usefully exploitable in any of
these places, but in the interests of safety, replace them.