Use constant-time delta base hash compare

F/2253

Author: danielinux

include/image.h

@@ -1252,6 +1252,8 @@ static void UNUSEDFUNCTION wolfBoot_image_clear_signature_ok(
 #endif
 
 /* Defined in image.c */
+int image_CT_compare(const uint8_t *expected, const uint8_t *actual,
+    uint32_t len);
 int wolfBoot_open_image(struct wolfBoot_image *img, uint8_t part);
 #ifdef EXT_FLASH
 int wolfBoot_open_image_external(struct wolfBoot_image* img, uint8_t part, uint8_t* addr);

src/image.c

@@ -58,7 +58,7 @@
 /* Globals */
 static uint8_t digest[WOLFBOOT_SHA_DIGEST_SIZE] XALIGNED(4);
 
-static int __attribute__((noinline)) image_CT_compare(
+int __attribute__((noinline)) image_CT_compare(
     const uint8_t *expected, const uint8_t *actual, uint32_t len)
 {
     uint8_t diff = 0;

src/update_flash.c

@@ -642,7 +642,7 @@ static int wolfBoot_delta_update(struct wolfBoot_image *boot,
                 cur_v, delta_base_v);
             ret = -1;
         } else if (!resume && delta_base_hash &&
-                memcmp(base_hash, delta_base_hash, base_hash_sz) != 0) {
+                !image_CT_compare(base_hash, delta_base_hash, base_hash_sz)) {
             /* Wrong base image digest, cannot apply delta patch */
             wolfBoot_printf("Delta Base hash mismatch\n");
             ret = -1;