Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca8d670c authored by tyiu's avatar tyiu Committed by Timothy Yiu
Browse files

RESTRICT AUTOMERGE: Fix HMAC Compare time attack 

Added constant time HMAC comparison preventing attackers being able to
forge HMAC for input by measuring the time difference between
non-constant time comparison of HMAC

Bug: 261085213
Test: None
Tag: #security
Change-Id: I7cd6b68589fd0042b9396dc599b917a0f3220ff7
parent 0905d591

services/inputflinger/dispatcher/InputDispatcher.cpp

+2 −1
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ 
#include <ftl/enum.h>

#include <gui/SurfaceComposerClient.h>

#include <input/InputDevice.h>

#include <openssl/mem.h>

#include <powermanager/PowerManager.h>

#include <unistd.h>

#include <utils/Trace.h>
@@ -4422,7 +4423,7 @@ std::unique_ptr<VerifiedInputEvent> InputDispatcher::verifyInputEvent(const Inpu 
    if (calculatedHmac == INVALID_HMAC) {

        return nullptr;

    }

    if (calculatedHmac != event.getHmac()) {

    if (0 != CRYPTO_memcmp(calculatedHmac.data(), event.getHmac().data(), calculatedHmac.size())) {

        return nullptr;

    }

    return result;