MACsec: Use os_memcmp_const() for hash/password comparisons

This makes the implementation less likely to provide useful timing
information to potential attackers from comparisons of information
received from a remote device and private material known only by the
authorized devices.

Signed-off-by: Jouni Malinen <j@w1.fi>

src/pae/ieee802_1x_kay.c

@@ -2942,8 +2942,9 @@ static int ieee802_1x_kay_mkpdu_sanity_check(struct ieee802_1x_kay *kay,
 						 mka_msg_len);
 
 	if (msg_icv) {
-		if (os_memcmp(msg_icv, icv,
-			      mka_alg_tbl[kay->mka_algindex].icv_len) != 0) {
+		if (os_memcmp_const(msg_icv, icv,
+				    mka_alg_tbl[kay->mka_algindex].icv_len) !=
+		    0) {
 			wpa_printf(MSG_ERROR,
 				   "KaY: Computed ICV is not equal to Received ICV");
 		return -1;