From 7236b9c0376864598246b6653274032bd9dbccb7 Mon Sep 17 00:00:00 2001
From: Oskar Eichler <oskar@songstats.com>
Date: Sun, 30 Aug 2026 01:22:09 +0200
Subject: [PATCH] Avoid recomputing HMAC digests during comparison

---
 lib/openssl/hmac.rb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/openssl/hmac.rb b/lib/openssl/hmac.rb
index c8c844d8d..099ae217b 100644
--- a/lib/openssl/hmac.rb
+++ b/lib/openssl/hmac.rb
@@ -5,9 +5,12 @@ class HMAC
     # Securely compare with another HMAC instance in constant time.
     def ==(other)
       return false unless HMAC === other
-      return false unless self.digest.bytesize == other.digest.bytesize
 
-      OpenSSL.fixed_length_secure_compare(self.digest, other.digest)
+      self_digest = digest
+      other_digest = other.digest
+      return false unless self_digest.bytesize == other_digest.bytesize
+
+      OpenSSL.fixed_length_secure_compare(self_digest, other_digest)
     end
 
     # :call-seq: