Blockstream Jade

This update fixes how Blockstream Jade handles QR-code-based recovery phrases imported in a specific format (bcur-bip39). Previously, a malformed or invalid recovery phrase could crash the device because the code used internal 'assert' checks that halt the device when they fail. The patch replaces those hard crashes with proper error handling, rejects obviously wrong inputs earlier (wrong number of words, words that are too long, empty words), and reduces memory used on the stack. It also adds tests for bad inputs. In practical terms, scanning a bad wallet QR code is now more likely to show a user-friendly error instead of freezing or rebooting the device.

This commit fixes a user-interface bug where the backspace icon was missing on the PIN entry screen and the checkmark/enter icon was missing on the index entry screen. It changes the number of allowed on-screen characters so the correct icons are displayed. There is no security issue here.

This update fixes a check in the Blockstream Jade hardware wallet's attestation setup. Before the fix, the code did not verify that an externally-provided signature was small enough to fit into its storage buffer. A too-large signature could overflow that buffer during verification, potentially corrupting memory or crashing the device. The patch adds a size check before calling the signature verification routine.

This commit tightens how Blockstream Jade handles the numbers inside OTP setup URLs (the 'counter' for HOTP codes and the 'period' for TOTP codes). Before the change, the code copied the number into a small temporary buffer and converted it with standard C library functions, which could silently accept non-digit characters, ignore overflow, or be fed an oversized input. The patch adds a strict decimal parser that only accepts digits, rejects values too large for the variable, and enforces length limits. The commit message credits the change to an external suggestion, but does not call it a security fix.

This commit replaces a hand-rolled string-to-number conversion when reading a firmware file's size from its filename with a stricter, shared helper function. The old code copied digits into a small temporary buffer and converted them with strtoul, which could mishandle very large numbers or edge cases. The new code validates that the value fits in a 32-bit unsigned integer and enforces the same maximum firmware size limit. It is a hardening/correctness improvement rather than a clear-cut fix for an actively exploitable vulnerability.

This commit tightens how firmware version strings are built and shown to the user during over-the-air (OTA) updates on Blockstream Jade hardware wallets. It removes a risky hand-rolled string-lowercase function, adds compile-time checks that string constants fit in their buffers, and prevents configuring a firmware that cannot actually be OTA flashed. The main security benefit is reducing the chance that a malformed or mismatched firmware image could confuse the user or crash the device during the update confirmation screen.

This commit fixes a display-drawing routine in the Blockstream Jade hardware wallet. The bug was that the code sometimes wrote two pixels at once (as a 32-bit value) even when the starting memory address was not properly aligned for such writes. The commit adds an alignment check before doing these faster double-width writes. The commit message says the alignment mismatch was found by AddressSanitizer (ASan), a memory-error detector. On its own this looks like a memory-safety/robustness fix rather than an exploitable vulnerability, because it is inside a screen-drawing function that receives already-validated coordinates and colors from the wallet's UI code.

This is a minor user-interface cleanup in the Blockstream Jade hardware wallet's screen-drawing code. It prevents the device from trying to redraw menu items before the screen layout has been fully calculated, which avoids harmless warnings, possible flicker, and wasted processor cycles. There is no indication this change fixes a security vulnerability or allows any attack.

This commit fixes a subtle type bug in the QR code display code of the Blockstream Jade hardware wallet. A value returned from a function was stored as a `bool` (true/false), but later used in a bit-shift operation. In C, shifting a `bool` by 32 or more bits is undefined behavior and was caught by an undefined-behavior sanitizer. The fix changes the variable type to `uint32_t` so the shift is well-defined. The practical security impact is likely low: it affects only QR rendering, not private keys or transaction signing, and hardware-wallet QR output is not attacker-controlled input. However, undefined behavior in embedded firmware is worth cleaning up because compilers may optimize it unpredictably.

This commit only changes user-facing text labels and removes an unused function parameter. The home screen button text changes from 'Unlock Jade' to 'Ready', and the connection screen now says 'Ready to Pair' with updated instructions. There is no security-relevant code change.

This commit increases the stack memory given to the device's on-screen user-interface task. The change is described as fixing a 'stack overflow' that could happen while verifying a special backup phrase called a 'BIP85 mnemonic.' A stack overflow in the screen task could crash the user interface or, in the worst case, be abused to disrupt the device during a sensitive wallet operation.

This commit removes the space key from the on-screen keyboard used when naming a one-time-password (OTP) account on the Jade hardware wallet. It also adds a general mechanism to block specific characters from being entered. The change prevents OTP names from containing spaces, which could previously cause problems when the name was later used in QR codes or other formats where spaces are not allowed. There is no direct evidence in the commit that this fixes an exploitable security vulnerability.

This commit is a user-experience improvement for setting up one-time password (OTP) accounts on the Jade hardware wallet. After scanning a QR code, the device now automatically fills the 'OTP Name' field with the website/service name (issuer) from the QR code, instead of making the user type it from scratch. It also adds a helper to clean up that name so it can be safely used as a storage key. There is no apparent security fix or vulnerability here.

This commit adds the ability for the Blockstream Jade hardware wallet to read Google Authenticator's bulk-export QR codes (the 'otpauth-migration://' format). It converts those exported codes back into normal OTP URIs and registers them. The change is a feature addition, not a documented security fix. Because it parses an external, attacker-controllable protobuf payload and builds URIs from it, there is some potential for parsing bugs or malformed data to cause crashes or unexpected behavior, but the commit itself does not obviously introduce a known vulnerability.

This commit refactors how Blockstream Jade handles Base32-encoded one-time-password (OTP) secrets. It moves the Base32 decoder into a shared utility, adds a new encoder, and makes padding characters ('=') stop decoding instead of being rejected. The change is a routine code cleanup; there is no direct evidence in the commit that it fixes an active security vulnerability.

This commit adds a new software component to the Blockstream Jade hardware wallet project. The component is a copy of the nanopb library plus generated code for parsing Google's OTP (one-time password) migration format. It is a dependency addition only: there is no actual user-facing feature or change to how secrets are handled in this commit. On its own, it does not fix or introduce a security vulnerability.

This commit fixes two security hygiene issues in the handling of one-time password (OTP) secrets in Blockstream Jade. First, it stops writing the raw OTP secret into device logs when decoding fails. Second, it marks the temporary memory buffer holding the decoded secret as sensitive so it is wiped after use rather than left behind. The change also removes a redundant size check because another function already performs it. There is no evidence in the commit of an active exploit or a reported incident.

This commit adds an optional logging switch to libjade, a Linux build of the Jade firmware used for in-process debugging. By default logging remains disabled, but developers can now turn it on with a --log flag. There is no security vulnerability here; it is a build/debugging convenience change.

This commit refactors how Blockstream Jade's firmware simulator (libjade) handles tasks when a GUI is enabled. It moves FreeRTOS task emulation into a separate file and uses real POSIX threads instead of running everything synchronously. There is no direct evidence in the commit or supplied references that this fixes a security vulnerability; it appears to be a feature/enablement change for the simulator's GUI mode.

This commit adds a new helper function that converts text into URL-encoded format (for example, turning spaces into '+' and special characters into '%XX'). It also makes a tiny internal helper function non-static-inline. There is no indication this fixes a security bug; it appears to be a routine feature addition.

This commit replaces a placeholder implementation of a binary semaphore with a real one. Previously, creating a binary semaphore actually created a mutex, which could cause incorrect synchronization behavior in the simulated FreeRTOS environment used for testing. The change makes the test/development environment behave more correctly, but it is not a fix for a remotely exploitable vulnerability in the actual Jade hardware wallet firmware.

This commit adds helper functions to convert FreeRTOS tick counts into regular clock time, and uses them to implement delay functions for the Blockstream Jade hardware wallet's simulator build. It is a normal feature/fix for the non-firmware simulator environment and does not appear to address a security vulnerability.

This commit changes how the Jade hardware wallet clears text shown on screen. Previously, ordinary memory freeing could leave sensitive strings (like seed words or passphrases) sitting in RAM. Now it uses a secure wipe function before freeing. The commit itself notes this is not a complete fix, because some UI elements are not yet covered by the secure-memory mechanism.

This commit adds a new on-screen feature that lets a user view the raw secret key for an OTP (one-time password) account they already have stored on their Jade hardware wallet. It is a user-interface change, not a remote attack. The main security consideration is that it makes it easier for someone with physical access to the unlocked device to read or photograph an OTP secret, whereas before only a QR-encoded URI could be displayed. The change also fixes a small UI inconsistency by using the standard back-button event ID.

This commit adds a new intermediate menu screen for one-time password (OTP) entries in the Blockstream Jade hardware wallet. When a user views an OTP, they now see a menu with 'View' and 'Export' options. The 'Export' button currently just shows a placeholder message saying the feature is not implemented yet. There is no security-relevant change in this commit.