Added constant time string comparison to avoid possible time-based attacks.

libraries/ArduinoOTA/ArduinoOTA.cpp

@@ -229,7 +229,7 @@ void ArduinoOTAClass::_onRx(){
     String result = _challengemd5.toString();
 
     ota_ip.addr = (uint32_t)_ota_ip;
-    if(result.equals(response)){
+    if(constantTimeEquals(result, response)){
       _state = OTA_RUNUPDATE;
     } else {
       _udp_ota->append("Authentication Failed", 21);
@@ -358,6 +358,27 @@ int ArduinoOTAClass::getCommand() {
   return _cmd;
 }
 
+// To avoid possible time-based attacks present function compares given 
+// strings in a constant time.
+bool ArduinoOTAClass::constantTimeEquals(const String & string1, 
+  const String & string2) {
+
+  // Preliminary check  
+  if(string1.length() != string2.length()) {
+	  return false;
+  }
+
+  // Evaluates every character
+  bool equals = true;
+  unsigned int len = string1.length();
+  for(unsigned int i = 0; i < len; i++){
+    equals &= (string1.charAt(i) == string2.charAt(i));
+  }
+
+  // Return result
+  return equals;
+}
+
 #if !defined(NO_GLOBAL_INSTANCES) && !defined(NO_GLOBAL_ARDUINOOTA)
 ArduinoOTAClass ArduinoOTA;
 #endif

libraries/ArduinoOTA/ArduinoOTA.h

@@ -93,6 +93,7 @@ class ArduinoOTAClass
     void _onRx(void);
     int parseInt(void);
     String readStringUntil(char end);
+	bool constantTimeEquals(const String &string1, const String &string2);
 };
 
 #if !defined(NO_GLOBAL_INSTANCES) && !defined(NO_GLOBAL_ARDUINOOTA)