Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b9bcb27e authored by Brian Delwiche's avatar Brian Delwiche Committed by Android (Google) Code Review
Browse files

Merge "Fix timing attack in BTM_BleVerifySignature" into tm-dev

parents d42f6181 7a960ac1
Loading
Loading
Loading
Loading
+4 −3
Original line number Diff line number Diff line
@@ -25,12 +25,15 @@

#define LOG_TAG "bt_btm_ble"

#include <base/logging.h>

#include <cstdint>

#include "device/include/controller.h"
#include "main/shim/btm_api.h"
#include "main/shim/l2c_api.h"
#include "main/shim/shim.h"
#include "openssl/mem.h"
#include "osi/include/allocator.h"
#include "osi/include/properties.h"
#include "stack/btm/btm_dev.h"
@@ -48,8 +51,6 @@
#include "stack/include/smp_api.h"
#include "types/raw_address.h"

#include <base/logging.h>

extern tBTM_CB btm_cb;

extern bool btm_ble_init_pseudo_addr(tBTM_SEC_DEV_REC* p_dev_rec,
@@ -2006,7 +2007,7 @@ bool BTM_BleVerifySignature(const RawAddress& bd_addr, uint8_t* p_orig,

    crypto_toolbox::aes_cmac(p_rec->ble.keys.pcsrk, p_orig, len,
                             BTM_CMAC_TLEN_SIZE, p_mac);
    if (memcmp(p_mac, p_comp, BTM_CMAC_TLEN_SIZE) == 0) {
    if (CRYPTO_memcmp(p_mac, p_comp, BTM_CMAC_TLEN_SIZE) == 0) {
      btm_ble_increment_sign_ctr(bd_addr, false);
      verified = true;
    }