mosquitto_memcmp_const is now more constant time.

ChangeLog.txt

@@ -19,6 +19,7 @@ Broker:
 - Broker will log warnings if sensitive files are world readable/writable, or
   if the owner/group is not the same as the user/group the broker is running
   as. In future versions the broker will refuse to open these files.
+- mosquitto_memcmp_const is now more constant time.
 
 Client library:
 - Use CLOCK_BOOTTIME when available, to keep track of time. This solves the

plugins/dynamic-security/auth.c

@@ -163,9 +163,7 @@ static int memcmp_const(const void *a, const void *b, size_t len)
 	if(!a || !b) return 1;
 
 	for(i=0; i<len; i++){
-		if( ((char *)a)[i] != ((char *)b)[i] ){
-			rc = 1;
-		}
+		rc |= ((char *)a)[i] ^ ((char *)b)[i];
 	}
 	return rc;
 }

src/password_mosq.c

@@ -201,9 +201,7 @@ int pw__memcmp_const(const void *a, const void *b, size_t len)
 	if(!a || !b) return 1;
 
 	for(i=0; i<len; i++){
-		if( ((char *)a)[i] != ((char *)b)[i] ){
-			rc = 1;
-		}
+		rc |= ((char *)a)[i] ^ ((char *)b)[i];
 	}
 	return rc;
 }

src/security_default.c

@@ -980,9 +980,7 @@ static int mosquitto__memcmp_const(const void *a, const void *b, size_t len)
 	if(!a || !b) return 1;
 
 	for(i=0; i<len; i++){
-		if( ((char *)a)[i] != ((char *)b)[i] ){
-			rc = 1;
-		}
+		rc |= ((char *)a)[i] ^ ((char *)b)[i];
 	}
 	return rc;
 }