Ledger Bitcoin app

This commit fixes a buffer handling bug in the Ledger Bitcoin app's wallet registration code. The app now reserves one extra byte for the wallet policy descriptor string and explicitly writes a null terminator (the 'end of string' marker). Without this fix, code that reads the descriptor as a text string could keep reading past the intended data, potentially leaking nearby memory or behaving unpredictably. The issue was reported by an external party called Cerberus.

This commit fixes a bug in the Ledger Bitcoin app where a flag indicating whether a wallet policy name should be shown could be left in an old/stale state during streaming transaction reviews. In practice, if a user had previously reviewed a transaction with a named wallet policy, a later transaction that should not show that name might incorrectly reuse the old name on screen. This is a user-interface consistency bug that could mislead the user about which wallet policy is authorizing a spend, but it does not directly expose private keys or allow unauthorized signing.

This commit only adds two new test cases to the project's unit tests. The tests check that the wallet policy parser correctly rejects 'thresh' descriptors with an invalid threshold number (zero or larger than the number of available sub-policies). It does not change any production code. The commit itself is a test-only change and appears to be preparing the ground for a later fix, but it signals that the developers have identified a parsing edge case that currently fails.

This commit fixes a missing safety check in the Ledger Bitcoin app's wallet policy parser. When reading a 'thresh(...)' policy (a multi-signature rule like '2 of 3 signatures needed'), the app now verifies that the required number of signatures (k) is not greater than the total number of available signers (n). Without this check, a malformed policy could ask for more signatures than keys exist, which could lead to an unusable or non-standard wallet policy being accepted by the device.

This commit only updates test screenshot snapshots (expected device screen images used by automated tests). No application code, firmware logic, or user-facing behavior was changed. It is not a security fix and does not introduce a vulnerability.

This commit adds a new way for the Ledger Bitcoin client to ask the device for the wallet's master key fingerprint (a short public identifier). It also keeps an older fallback method for compatibility with devices that do not yet support the new command. The change is a feature addition in the client library, not a fix for a known vulnerability, and the commit message does not describe any security problem.

This commit fixes a bug where signing an empty Bitcoin message could cause the Ledger device to display random leftover data from its memory instead of a clean empty message. The fix simply ensures the message buffer starts as an empty string before any data is copied into it. This is an information disclosure issue: an attacker who can trigger an empty message signing request might get the device to show uninitialized stack memory on screen. It does not appear to allow stealing coins directly, but it is a security-relevant bug in a trusted display path.

This commit only updates three test screenshot images used for comparing the app's dashboard display during automated testing. No application code, logic, or security-sensitive files were changed.

This commit fixes two bugs in the Ledger Bitcoin app's MuSig (multi-signature) signing code. First, a function that should return true/false was returning -1 on error, which could be misinterpreted as 'true' (success). Second, after detecting a failed signature aggregation and sending an error code to the computer, the code kept running instead of stopping, which could lead to signing with invalid or partial data. Both are security-relevant control-flow bugs in a cryptocurrency signing path.

This commit only changes the displayed copyright year from 2025 to 2026 in the app's about/credits screen. It is a routine legal notice update with no security relevance.

This commit only bumps the app version number from 2.4.5 to 2.4.6 and updates the changelog. It does not change any source code, cryptographic logic, or security behavior. The changelog mentions that a prior release fixed a miniscript policy issue, but this commit itself is purely administrative packaging.

This commit only adds documentation comments to a header file describing existing functions. No code behavior was changed, so it cannot introduce or fix a security issue on its own.

This commit fixes a length check in the Ledger Bitcoin app's PSBT signing code. Before reading the 9th byte of a witness UTXO field, the code now verifies the field is at least 9 bytes long. Previously, it only checked that some data was returned, which could lead to reading past the end of a malformed or truncated input. This is a defensive fix against an out-of-bounds read that could affect transaction amount calculations during signing.

This commit only updates test screenshot snapshots for the Ledger Bitcoin app. It renames and replaces image files used by the Ragger automated UI testing framework, changing test case names from '4to17' and '4to18' to '4toMax' and '4toMaxPlus1'. No application source code, firmware, or runtime behavior is modified, so there is no direct security impact on users.

This commit only changes test helper code so that automated tests for the Ledger Bitcoin app use a smaller number of outputs on the Nano X device. It does not change the actual app firmware. The change is a test-suite adaptation to match a previously reduced Nano X limit, not a fix for a new security bug.

A single-line fix in Ledger's Bitcoin app changes a memory allocation from using the size of a pointer to using the size of the actual data structure. On the 32-bit ARM hardware used by Ledger devices, both sizes happen to be 4 bytes, so the bug had no practical effect there. On a different architecture with larger pointers, the allocation would have been too small, potentially causing memory corruption when the structure is later written to. The commit message explicitly says this was not a bug on current 32-bit ARM devices.

This commit adds a safety limit to a recursive function called parse_script in Ledger's Bitcoin app. Without such a limit, an attacker could potentially feed the device an extremely nested Bitcoin script that causes the function to call itself so many times that the device's limited stack memory runs out. A stack overflow on a hardware wallet could crash the app or, in worst cases, be exploited to alter behavior. The fix caps nesting at 16 levels, which is above any realistic legitimate use.

This commit fixes a small but real off-by-one buffer sizing bug in the Ledger Bitcoin app's wallet code. A string buffer meant to hold a serialized extended public key was sized to the maximum character length, but C strings need an extra byte for the terminating null character ('\0'). Without that extra byte, code later reading or copying the string could read past the buffer or write the terminator into adjacent memory, which on a constrained hardware wallet could potentially leak secrets or cause a crash. The fix adds the missing +1 byte.

This commit fixes a spelling mistake in a code comment ('singla' to 'single'). It does not change any executable code, logic, or behavior of the Ledger Bitcoin app. There is no security impact.

This commit is a code cleanup with no functional change. It removes an unnecessary comparison to 'true' in two boolean checks. The behavior of the program is identical before and after the change.

This commit is a simple code cleanup: it replaces two hard-coded copies of the maximum possible number of satoshis in existence with a single named constant. The actual safety check and the numeric value it compares against remain exactly the same, so there is no security change.

This commit adds a safety check to the Ledger Bitcoin app's transaction-signing code. Before signing a Bitcoin transaction, the app now refuses if the transaction has more outputs than a defined maximum. Without this check, a specially crafted transaction with an extremely large number of outputs could potentially overflow internal counters or exhaust memory, leading to crashes or unexpected behavior on the hardware wallet.

This is a routine JavaScript library upgrade. The project moved its bitcoinjs-lib dependency from version 6 to version 7, which changed some internal return types from Buffer to Uint8Array and from number to bigint. The commit adds small adapter functions (like Buffer.from(...) and a bigint-to-number helper) so the rest of the code keeps working without wider rewrites. There is no direct evidence in the commit that this fixes an active security vulnerability; it reads as a compatibility/refactoring change.

This commit only updates screenshot files used for automated UI testing. There are no changes to the actual Ledger Bitcoin app code, so it cannot directly affect device security or user funds.

This commit only changes user-facing text strings in the Ledger Bitcoin app. It capitalizes 'Bitcoin' as 'bitcoin' in a few labels and rewords some warning messages to be clearer. There are no code logic changes, no security fixes, and no behavior changes.