From a403278fe67cbb09ada7b7c35844310ef04b6be2 Mon Sep 17 00:00:00 2001
From: zzz <zzz@i2pmail.org>
Date: Mon, 11 May 2026 07:37:25 -0400
Subject: [PATCH] Util: eqCT() null check

---
 core/java/src/net/i2p/data/DataHelper.java | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/core/java/src/net/i2p/data/DataHelper.java b/core/java/src/net/i2p/data/DataHelper.java
index f139a405a..17cce3f76 100644
--- a/core/java/src/net/i2p/data/DataHelper.java
+++ b/core/java/src/net/i2p/data/DataHelper.java
@@ -1131,16 +1131,17 @@ public class DataHelper {
     }
 
     /**
-     *  This throws NPE if either lhs or rhs is null.
+     *  This returns false if either lhs or rhs is null.
      *  Constant time, almost.
      *  Warning: not constant time if secret is empty.
      *
      *  @param user user-supplied String, will attempt for time to be proportional to this length
      *  @param secret internal String, will attempt for time to be independent of this length
-     *  @throws NullPointerException if either arg is null
      *  @since 0.9.70
      */
     public final static boolean eqCT(String user, String secret) {
+        if (user == null || secret == null)
+            return false;
         int ul = user.length();
         int sl = secret.length();
         if (ul == 0)