Trezor firmware

This commit fixes an out-of-bounds memory read bug in the Trezor bootloader's firmware header parser. The read_vendor_header function previously trusted size values inside a firmware file without first checking whether those sizes fit within the actual data buffer. A malformed firmware update or a corrupted on-device firmware image could have caused the bootloader to read memory beyond the allowed region. The patch adds size checks so the parser rejects too-small or oversized headers before using their contents.

This commit renames and restructures how Trezor firmware selects cryptographic signing keys for bootloaders. Previously, non-production builds automatically used weaker development/QA keys. Now, a dedicated BOOTLOADER_DEVEL flag controls that, while a separate FORCE_BOOTLOADER_UPGRADE flag controls whether the firmware should forcibly update the bootloader. The change also prevents combining PRODUCTION=1 with BOOTLOADER_DEVEL=1. This is primarily a build-hardening and internal workflow cleanup; it does not by itself fix a remotely exploitable bug in shipped devices.

This commit fixes a bug in the Trezor hardware wallet's NFC driver where calling the NFC shutdown function more than once could crash the device. The fix adds a simple check to skip re-deinitializing the SPI hardware if it has already been shut down. It is a defensive hardening fix rather than a clear exploitable vulnerability.

This is a minor code cleanup that changes when a debug-only warning message is printed. It does not fix or introduce any security issue. The change simply avoids logging a misleading warning when no backup method is selected in a non-production debug build.

This commit only updates the expected visual-output fingerprints (called 'fixtures') used by the device's automated UI tests. It renames test cases to include a '[Display]' marker and adjusts the corresponding hashes, but does not change any firmware code that runs on the Trezor device itself. There is no security-relevant change visible in this commit.

This commit adds a new backup and recovery method called N4W1 to Trezor firmware. It is a feature addition that lets users back up and restore their wallet seed using a near-field wireless tag instead of typing words on the device screen. The change is mostly about adding new code paths and tests; it does not appear to fix a known security bug, nor does the vendor describe it as a security patch.

This is a routine lock-file update for a Python dependency manager. It records that an internal Trezor package named 'tvl' now depends on two additional libraries ('cffi' and 'libcst'). There is no indication of a security fix, vulnerability, or malicious change in the commit itself.

This commit is a simple code cleanup in the Ethereum clear-signing module. It pulls out a repeated snippet of code that reads variable-length data into a new helper function, then replaces two copies of that snippet with calls to the helper. No behavior changes are visible in the diff.

This commit adds a length check to a function that parses arrays of 256-bit unsigned integers in Ethereum transaction data. Previously, if the raw data was not a multiple of 32 bytes, the function would silently ignore leftover bytes at the end. The fix now raises an error instead. This could matter for 'clear signing' displays on a Trezor hardware wallet, where malformed data might otherwise be shown or processed in a misleading way. The commit message does not describe this as a security fix, and no exploit is demonstrated.

This commit replaces runtime computation of two Ethereum function signatures with hard-coded byte values, then adds debug-only assertions to verify those values still match the original computation. It is a minor code cleanup with no apparent security impact. The change does not alter what the device signs, displays, or accepts.

This commit adds a safety check to a function that verifies unused data is zeroed. Before the change, if a caller passed an invalid 'used_bytes' value (for example, a negative number or one larger than 32), the function could read memory outside the intended 32-byte window or behave unexpectedly. The patch now rejects such invalid values immediately. The commit message calls it a routine cleanup ('chore') and does not claim it fixes a security vulnerability.

This commit tightens validation in Trezor's Ethereum 'clear signing' feature. It now rejects cases where a host computer tells the device to parse a variable-length type (like a string or byte blob) as if it were a fixed 32-byte value, or vice versa. This reduces the chance that a malicious or buggy host could trick the device into misreading transaction data, but the commit itself does not claim to fix a specific known attack.

This commit replaces several 'assert' checks in the Ethereum 'clear signing' code with proper error handling. In production firmware, asserts can be stripped out or behave differently than expected, so replacing them with explicit error raises makes the code more robust against malformed or malicious transaction data. The change is defensive hardening rather than a clear fix for an active exploit.

This commit fixes an off-by-one-style bounds check in the Ethereum clear-signing code on Trezor hardware wallets. The old check only verified that the starting position was inside the data, but did not verify that the code was about to read 32 bytes from that position. As a result, a malformed Ethereum transaction or message could trick the device into reading past the end of a buffer while decoding human-readable fields. The fix now checks that offset plus 32 bytes does not exceed the data length before reading.

This commit adds a new feature to Trezor Ethereum signing that lets the device ask the connected computer or phone for extra token/contract display information during a transaction. It is a feature addition (not a direct bug fix), so it mainly changes how the wallet and device talk to each other. There is no clear security vulnerability visible in the diff, but any new request/response protocol introduces places where a malicious or buggy host could supply misleading data, and the device must carefully validate what it receives. The commit does not itself describe a security issue or credit a researcher.

This commit adds support for a new 'To' container path in Trezor's Ethereum clear-signing feature. It lets the device reference the transaction recipient when formatting token amounts, which is useful for displaying ERC-20 transfers and approvals correctly. The change is a feature addition, not a clear security fix, and there is no evidence of a disclosed vulnerability.

This commit tightens a security rule in Trezor's Ethereum signing code: payment requests can now only be used with plain ERC-20 token transfers. Previously, the code may have allowed payment requests with other smart-contract calls, which could let a malicious app or service trick a user into approving a different transaction than expected while still showing a familiar payment-request screen.

This commit adds a new feature to Trezor's Ethereum signing flow: the device can now ask the host computer mid-transaction for extra token or display-format definitions. The main production code change is small and appears to fix a token-resolution bug in clear signing by preferring a token returned from the parsed field data over the one looked up from the static definitions. Most of the diff is new and updated test code exercising the new request/response mechanism and renaming helpers from 'erc7730' to the more generic 'display format'.

This commit changes how Trezor displays Ethereum token-approval amounts that exceed a safety threshold. Previously, the code returned 'None' for such large amounts, and the user interface fell back to a generic 'Unlimited amount' warning. Now the formatter explicitly returns a special 'AboveThreshold' marker carrying the text 'Unlimited', and each device UI layout uses that marker to show the same warning and display text. The change is a user-interface refinement, not a fix for a cryptographic bug or a remote exploit. It does, however, make the 'unlimited' signal explicit rather than implicit, which slightly reduces the chance that a future UI change would accidentally treat a huge allowance as an ordinary amount.

This commit only adds new expected screen-shot fingerprints (hashes) for automated user-interface tests of Ethereum token-definition request features. It does not change any firmware, application, or cryptographic code. There is no security-relevant change in the shipped product.

This commit updates a third-party vendor library called ts-tvl from one version to version 2.4. No actual code changes are visible in the supplied materials, and no security relevance is stated. It appears to be a routine dependency maintenance task.

This is a routine configuration cleanup for the Tropic secure-element model used in Trezor hardware wallets. It changes how firmware version numbers are written into a test/tooling config file (from a manually encoded binary blob to a plain version string) and explicitly pins a second firmware version to 1.0.0. There is no indication this fixes or introduces a security vulnerability.

This commit simply deletes two unused helper functions that set padding for notification screens in two different visual themes. There is no security relevance: no behavior changes, no bug fixes, and no attacker-accessible surface is introduced or removed.

This commit changes how Trezor devices reveal a passphrase on screen while typing. Previously, the revealed passphrase would hide again if the user's finger slid outside a specific extended area below the input box. Now, the passphrase stays visible until the user simply lifts their finger anywhere on the screen. This is a user-experience refinement, not a security fix or vulnerability.

This is a routine cleanup change that removes an unused visual border feature from the Trezor firmware's Delizia user interface. It does not change any security-sensitive behavior; it only simplifies the code by deleting a function that always returned zero-width borders and updating two places that called it to no longer use a border wrapper.