Use SafeMemcmp() in RSAVerify() just to be safe.

firmware/lib/cryptolib/rsa.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 /* Implementation of RSA signature verification which uses a pre-processed
  * key for computation. The code extends Android's RSA verification code to
  * support multiple RSA key lengths and hash digest algorithms.
  */
 
@@ skipping 111 matching lines @@
 }
 
 /* Verify a RSA PKCS1.5 signature against an expected hash.
  * Returns 0 on failure, 1 on success.
  */
 int RSAVerify(const RSAPublicKey *key,
               const uint8_t *sig,
               const uint32_t sig_len,
               const uint8_t sig_type,
               const uint8_t *hash) {
-  int i;
   uint8_t* buf;
   const uint8_t* padding;
+  int padding_len;
   int success = 1;
 
   if (!key || !sig || !hash)
     return 0;
 
   if (sig_len != (key->len * sizeof(uint32_t))) {
     VBDEBUG(("Signature is of incorrect length!\n"));
     return 0;
   }
 
   if (sig_type >= kNumAlgorithms) {
     VBDEBUG(("Invalid signature type!\n"));
     return 0;
   }
 
   if (key->len != siglen_map[sig_type] / sizeof(uint32_t)) {
     VBDEBUG(("Wrong key passed in!\n"));
     return 0;
   }
 
   buf = (uint8_t*) Malloc(sig_len);
   if (!buf)
     return 0;
   Memcpy(buf, sig, sig_len);
 
   modpowF4(key, buf);
 
   /* Determine padding to use depending on the signature type. */
   padding = padding_map[sig_type];
+  padding_len = padding_size_map[sig_type];
+
+  /* Even though there are probably no timing issues here, we use
+   * SafeMemcmp() just to be on the safe side. */
 
   /* Check pkcs1.5 padding bytes. */
-  for (i = 0; i < padding_size_map[sig_type]; ++i) {
-    if (buf[i] != padding[i]) {
-#ifndef NDEBUG
-      VBDEBUG(("Padding: Expecting = %02x Got = %02x\n", padding[i], buf[i]));
-#endif
-      success = 0;
-    }
+  if (SafeMemcmp(buf, padding, padding_len)) {
+    VBDEBUG(("In RSAVerify(): Padding check failed!\n"));
+    success = 0;
   }
 
-  /* Check if digest matches. */
-  for (; i < (int)sig_len; ++i) {
-    if (buf[i] != *hash++) {
-#ifndef NDEBUG
-      VBDEBUG(("Digest: Expecting = %02x Got = %02x\n", padding[i], buf[i]));
-#endif
-      success = 0;
-    }
+  /* Check hash. */
+  if (SafeMemcmp(buf + padding_len, hash, sig_len - padding_len)) {
+    VBDEBUG(("In RSAVerify(): Hash check failed!\n"));
+    success  = 0;
   }
-
   Free(buf);
 
   return success;
 }