Use 2nd stack for update signature verification

[earlephilhower]

Fixes #7145

When doing a signed update, the signature calculation can use a lot of
stack, so move it silently to the BearSSL second stack.

Also fix a memory leak of signature-bytes found by @JiriBilek

[JiriBilek]

Apologies for a silly question: how can I test it? Is it fine just to get and replace changed files in my nearly-up-to-date repository copy?

[earlephilhower]

You can try that, or use the GIT method described here:
https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/checking-out-pull-requests-locally

[JiriBilek]

Tested on my application, the stack size remains the same before and after the update (not a big surprise, though), no crashes so far.
Thanks for a quick fix!

[bastidest]

I found this issue while debugging OTA signature verification problems. This PR seems to break the signed OTA updates for me. It seems to be stuck right after calling thunk_SigningVerifier_verify(_pubKey, hash, signature, signatureLen);

After this patch it works fine again:

@@ -899,7 +899,7 @@
 
 bool SigningVerifier::verify(UpdaterHashClass *hash, const void *signature, uint32_t signatureLen) {
   if (!_pubKey || !hash || !signature || signatureLen != length()) return false;
-#if !CORE_MOCK
+#if CORE_MOCK
     return thunk_SigningVerifier_verify(_pubKey, hash, signature, signatureLen);
 #else
     return SigningVerifier_verify(_pubKey, hash, signature, signatureLen);

I don't know if that is directly related with this PR, otherwise I can open an issue.

[devyte]

Please open a new issue and follow the template instructions.