Eliminate harmless non-constant time operations on secret data.

There were several places where the code was non-constant time
 for invalid secret inputs.  These are harmless under sane use
 but get in the way of automatic const-time validation.

(Nonce overflow in signing is not addressed, nor is s==0 in
 signing)

src/util.h

@@ -160,4 +160,16 @@ static SECP256K1_INLINE void *manual_alloc(void** prealloc_ptr, size_t alloc_siz
 SECP256K1_GNUC_EXT typedef unsigned __int128 uint128_t;
 #endif
 
+/* Zero memory if flag == 1. Constant time. */
+static SECP256K1_INLINE void memczero(void *s, size_t len, int flag) {
+    unsigned char *p;
+    unsigned char mask = -(unsigned char)flag;
+    p = (unsigned char *)s;
+    while (len) {
+        *p ^= *p & mask;
+        p++;
+        len--;
+    }
+}
+
 #endif /* SECP256K1_UTIL_H */