diff --git a/mozilla/security/nss/lib/ssl/ssl3con.c b/mozilla/security/nss/lib/ssl/ssl3con.c
index 17506783e83..d25c070ea59 100644
--- a/mozilla/security/nss/lib/ssl/ssl3con.c
+++ b/mozilla/security/nss/lib/ssl/ssl3con.c
@@ -39,7 +39,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: ssl3con.c,v 1.116 2009-03-04 21:57:18 nelson%bolyard.com Exp $ */
+/* $Id: ssl3con.c,v 1.117 2009-10-16 17:45:35 wtc%google.com Exp $ */
 
 #include "cert.h"
 #include "ssl.h"
@@ -7723,7 +7723,7 @@ ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
 	rv = ssl3_ComputeTLSFinished(ss->ssl3.crSpec, !isServer, 
 	                             hashes, &tlsFinished);
 	if (rv != SECSuccess ||
-	    0 != PORT_Memcmp(&tlsFinished, b, length)) {
+	    0 != NSS_SecureMemcmp(&tlsFinished, b, length)) {
 	    (void)SSL3_SendAlert(ss, alert_fatal, decrypt_error);
 	    PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
 	    return SECFailure;
@@ -7735,7 +7735,7 @@ ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
 	    return SECFailure;
 	}
 
-	if (0 != PORT_Memcmp(hashes, b, length)) {
+	if (0 != NSS_SecureMemcmp(hashes, b, length)) {
 	    (void)ssl3_HandshakeFailure(ss);
 	    PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
 	    return SECFailure;
@@ -8286,7 +8286,8 @@ const ssl3BulkCipherDef *cipher_def;
 
     /* Check the MAC */
     if (hashBytes != (unsigned)crSpec->mac_size || padIsBad || 
-	PORT_Memcmp(databuf->buf + databuf->len, hash, crSpec->mac_size) != 0) {
+	NSS_SecureMemcmp(databuf->buf + databuf->len, hash,
+	                 crSpec->mac_size) != 0) {
 	/* must not hold spec lock when calling SSL3_SendAlert. */
 	ssl_ReleaseSpecReadLock(ss);
 	SSL3_SendAlert(ss, alert_fatal, bad_record_mac);
diff --git a/mozilla/security/nss/lib/ssl/sslcon.c b/mozilla/security/nss/lib/ssl/sslcon.c
index 38476f26054..5aad5f5d41f 100644
--- a/mozilla/security/nss/lib/ssl/sslcon.c
+++ b/mozilla/security/nss/lib/ssl/sslcon.c
@@ -37,7 +37,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: sslcon.c,v 1.36 2009-03-04 21:57:18 nelson%bolyard.com Exp $ */
+/* $Id: sslcon.c,v 1.37 2009-10-16 17:45:35 wtc%google.com Exp $ */
 
 #include "nssrenam.h"
 #include "cert.h"
@@ -2731,7 +2731,8 @@ ssl2_HandleVerifyMessage(sslSocket *ss)
     DUMP_MSG(29, (ss, data, ss->gs.recordLen));
     if ((ss->gs.recordLen != 1 + SSL_CHALLENGE_BYTES) ||
 	(data[0] != SSL_MT_SERVER_VERIFY) ||
-	PORT_Memcmp(data+1, ss->sec.ci.clientChallenge, SSL_CHALLENGE_BYTES)) {
+	NSS_SecureMemcmp(data+1, ss->sec.ci.clientChallenge,
+	                 SSL_CHALLENGE_BYTES)) {
 	/* Bad server */
 	PORT_SetError(SSL_ERROR_BAD_SERVER);
 	goto loser;
diff --git a/mozilla/security/nss/lib/ssl/sslgathr.c b/mozilla/security/nss/lib/ssl/sslgathr.c
index a349ab1ba0b..e4a49e1aefb 100644
--- a/mozilla/security/nss/lib/ssl/sslgathr.c
+++ b/mozilla/security/nss/lib/ssl/sslgathr.c
@@ -36,7 +36,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: sslgathr.c,v 1.9 2007-07-06 03:16:54 julien.pierre.bugs%sun.com Exp $ */
+/* $Id: sslgathr.c,v 1.10 2009-10-16 17:45:35 wtc%google.com Exp $ */
 #include "cert.h"
 #include "ssl.h"
 #include "sslimpl.h"
@@ -309,7 +309,7 @@ ssl2_GatherData(sslSocket *ss, sslGather *gs, int flags)
 
 	    ssl_ReleaseSpecReadLock(ss);  /******************************/
 
-	    if (PORT_Memcmp(mac, pBuf, macLen) != 0) {
+	    if (NSS_SecureMemcmp(mac, pBuf, macLen) != 0) {
 		/* MAC's didn't match... */
 		SSL_DBG(("%d: SSL[%d]: mac check failed, seq=%d",
 			 SSL_GETPID(), ss->fd, ss->sec.rcvSequence));
diff --git a/mozilla/security/nss/lib/util/nssutil.def b/mozilla/security/nss/lib/util/nssutil.def
index f679db8d24f..933b531c57a 100644
--- a/mozilla/security/nss/lib/util/nssutil.def
+++ b/mozilla/security/nss/lib/util/nssutil.def
@@ -241,3 +241,9 @@ UTIL_SetForkState;
 ;+    local:
 ;+       *;
 ;+};
+;+NSSUTIL_3.12.5 {       # NSS Utilities 3.12.5 release
+;+    global:
+NSS_SecureMemcmp;
+;+    local:
+;+       *;
+;+};
diff --git a/mozilla/security/nss/lib/util/secport.c b/mozilla/security/nss/lib/util/secport.c
index 8c53ac73802..c6d2f039aac 100644
--- a/mozilla/security/nss/lib/util/secport.c
+++ b/mozilla/security/nss/lib/util/secport.c
@@ -41,7 +41,7 @@
  * 
  * NOTE - These are not public interfaces
  *
- * $Id: secport.c,v 1.24 2009-07-30 23:28:21 nelson%bolyard.com Exp $
+ * $Id: secport.c,v 1.25 2009-10-16 17:45:36 wtc%google.com Exp $
  */
 
 #include "seccomon.h"
@@ -667,3 +667,21 @@ NSS_PutEnv(const char * envVarName, const char * envValue)
 #endif
 }
 
+/*
+ * Perform a constant-time compare of two memory regions. The return value is
+ * 0 if the memory regions are equal and non-zero otherwise.
+ */
+int
+NSS_SecureMemcmp(const void *ia, const void *ib, size_t n)
+{
+    const unsigned char *a = (const unsigned char*) ia;
+    const unsigned char *b = (const unsigned char*) ib;
+    size_t i;
+    unsigned char r = 0;
+
+    for (i = 0; i < n; ++i) {
+        r |= *a++ ^ *b++;
+    }
+
+    return r;
+}
diff --git a/mozilla/security/nss/lib/util/secport.h b/mozilla/security/nss/lib/util/secport.h
index 4f7fb663e8b..187474e0962 100644
--- a/mozilla/security/nss/lib/util/secport.h
+++ b/mozilla/security/nss/lib/util/secport.h
@@ -37,7 +37,7 @@
 /*
  * secport.h - portability interfaces for security libraries
  *
- * $Id: secport.h,v 1.21 2009-04-08 01:07:00 julien.pierre.boogz%sun.com Exp $
+ * $Id: secport.h,v 1.22 2009-10-16 17:45:36 wtc%google.com Exp $
  */
 
 #ifndef _SECPORT_H_
@@ -240,6 +240,8 @@ sec_port_iso88591_utf8_conversion_function
 
 extern int NSS_PutEnv(const char * envVarName, const char * envValue);
 
+extern int NSS_SecureMemcmp(const void *a, const void *b, size_t n);
+
 SEC_END_PROTOS
 
 #endif /* _SECPORT_H_ */