From 854a36248e94cc74a1df97abb1eba4f0ca0f0b4f Mon Sep 17 00:00:00 2001
From: Paul Adelsbach <paul.adelsbach@wolfssl.com>
Date: Mon, 13 Apr 2026 10:19:24 -0700
Subject: [PATCH] Replace WMEMCMP in CheckAuthKeysLine

---
 apps/wolfsshd/auth.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/wolfsshd/auth.c b/apps/wolfsshd/auth.c
index 8a7eaebee..f679b1f2f 100644
--- a/apps/wolfsshd/auth.c
+++ b/apps/wolfsshd/auth.c
@@ -229,7 +229,10 @@ static int CheckAuthKeysLine(char* line, word32 lineSz, const byte* key,
         }
     }
     if (ret == WSSHD_AUTH_SUCCESS) {
-        if (keyCandSz != keySz || WMEMCMP(key, keyCand, keySz) != 0) {
+        /* Constant-time compare to avoid leaking which prefix bytes of an
+         * authorized key match a candidate offered by a remote peer. */
+        if (keyCandSz != keySz ||
+                ConstantCompare(key, keyCand, keySz) != 0) {
             ret = WSSHD_AUTH_FAILURE;
         }
     }