bitcoin/bitcoin — pull request #2845 by grayleonard (2013-07-23 00:39:44+00:00)
Title: Mitigate Timing Attacks On Basic RPC Authorization

As per #2838 . Eliminates the possibility of timing attacks by changing the way the two passwords are compared. See http://rdist.root.org/2010/01/07/timing-independent-array-comparison/ for reference.

It iterates through each char in the strings, and if the two chars it is comparing aren't the same, then it adds 1 to nReturn and the function returns false. Previously, the function would return false on the first char that didn't match, allowing a possible attacker to run a timing attack.