Trezor firmware

This commit fixes a security boundary check in the Trezor firmware's system-call verifier. The old code trusted a user-supplied string pointer and measured its length with strlen(), which can read beyond allowed memory if the string is malformed or malicious. The fix makes the caller provide the string length explicitly and checks exactly that many bytes. This closes a likely path for a restricted app to trick the device into reading memory it shouldn't, potentially causing a crash or leaking secrets.

This commit fixes a function that reads translated text data from the hardware wallet's flash storage. Previously, if a caller requested data starting at an offset beyond the end of the translation area, the function would calculate a negative-looking length (because unsigned arithmetic wraps around) and return a pointer to an invalid memory location. The fix checks whether the offset is too large and returns NULL instead. This could have allowed malformed or attacker-controlled data to trick the device into reading memory outside the intended translation area, potentially causing crashes or exposing unrelated flash contents.

This commit changes two system call handlers in Trezor's firmware so that translation-related read/write operations go through 'verified' versions of functions. The change suggests the previous unverified versions may have allowed untrusted code (apps running on the device) to access or modify translation data in unsafe ways, such as passing bad memory pointers or lengths. Without the verified wrapper, a malicious or buggy app could potentially corrupt memory or read/write data it should not. The patch is very small and does not show the verifier code itself, so we cannot confirm the exact bug or exploit path.

This commit is a straightforward code cleanup: it renames functions like flash_configure_option_bytes() to option_bytes_configure() and check_oem_keys() to option_bytes_check_oem_keys(), makes several internal helpers static (visible only within one file), and changes the compile-time guard from KERNEL_MODE to SECURE_MODE. The actual logic that checks and writes the chip's security option bytes is unchanged. There is no indication this fixes a security bug or introduces a vulnerability.

This commit changes build configuration files for several Trezor hardware wallet models so that a special debug helper file for physical buttons is included only when the 'usb_iface_debug' feature is requested. It does not change user-facing behavior in normal production builds. The change appears to be a build-system cleanup to make debug-only button code compile correctly on button-based devices, not a fix for an active security vulnerability.

This commit adds a debug-only feature that lets software simulate physical button presses (press, release, click) on Trezor hardware wallets. It is compiled in only when the DEBUGLINK build flag is set, which is intended for development and automated testing, not production firmware. The feature could let a connected debugging host or test harness inject fake button events into the normal button-handling path.

This commit adds a debug-only feature to the Trezor hardware wallet firmware that lets developers inject fake touch-screen events (taps, swipes, clicks) into the touch driver. It is gated behind the DEBUGLINK build flag, which is used only in development/testing builds, not in production firmware shipped to users. The change itself is a feature implementation; there is no direct evidence in the commit that it fixes a security bug or that it introduces an exploitable vulnerability in production devices.

This commit only adds a new internal queue component to the Unix build of the Trezor firmware. It is a build-system change with no visible security effect on its own.

This commit only adds stub (mock) implementations of interrupt-locking functions for the Trezor emulator build. It also fixes a typo in a comment. There is no security-relevant code change.

This commit only changes build configuration files for Trezor hardware wallets. It adds the debug touch and button source files to the compilation when a debug USB interface is requested. There is no change to runtime behavior, user-facing functionality, or security logic. It is a build-system chore.

This commit introduces a new build flag called DEBUGLINK that controls whether Trezor firmware is compiled with debug/test-only USB and screen-recording features enabled. It does not add new runtime behavior; it mostly reorganizes when these debug features are included. The change makes debug builds more explicit, but it also means enabling DEBUGLINK (or disabling optimizations via PYOPT=0) automatically turns on the debug USB interface and screen recording. In a production device this could be risky, but the commit itself is a build-system refactor and the features remain off by default for production builds.

This commit adds a debug-only feature to the Trezor bootloader that lets automated testing tools talk to the bootloader over a special USB debug channel. It is controlled by a build-time flag (DEBUGLINK=1) and is not enabled in normal production firmware. The feature can read screen contents, simulate button presses and touch events, and record the screen. It does not appear to be a vulnerability by itself, but it is a powerful debugging interface that must remain disabled in production devices.

This commit adds a way to turn off progress animations in the Trezor bootloader. When animations are disabled, the progress value is forced to 0 so the screen does not show a moving progress bar. There is no direct security fix here; it is a user-experience or accessibility change, likely to support a setting that disables animations.

This commit updates the Python image-processing library Pillow from a vulnerable version to a fixed one, but only for users running Python 3.10 or newer. The commit message explicitly says it fixes an out-of-bounds write vulnerability in Pillow, and that the vulnerable library is only used by a command-line helper tool called toiftool, not by the Trezor firmware that runs on the hardware wallet itself. So the security risk is limited to developers or build machines that use that helper tool with Python 3.10+.

This commit changes a GitHub Actions workflow so that an automated fuzz-testing job only runs on public copies of the repository. It does not change the Trezor firmware code, device behavior, or any security-sensitive logic. The change is purely a CI configuration fix to avoid test failures in private forks that lack authentication for the fuzzing service.

This commit is a routine GitHub Actions workflow hardening change. It restricts an internal automation bot so it only runs in the official Trezor firmware repository, limits it to newly opened issues and pull requests, merges two nearly identical jobs into one, and pins a third-party action to a specific version. There is no indication this fixes an active security vulnerability or affects the Trezor device firmware or user funds.

This is a small build-script change for Trezor hardware wallets. It adds the new 'kernel' build artifact to the list of files copied out of the Docker build container, and makes the script continue copying artifacts even when a fingerprinting step fails. There is no direct evidence this fixes a security vulnerability; it appears to be a CI/build hygiene improvement.

This is a small GitHub Actions CI workflow change. It tells the workflow to upload build artifacts even when a previous build step fails. This is a normal reliability/debugging improvement and does not change any firmware code, cryptography, or device behavior. There is no security issue visible in this commit.

This is a routine automated dependency update by Dependabot, bumping the Rust crate 'static-alloc' from version 0.2.4 to 0.2.6. Only two metadata files (Cargo.lock and Cargo.toml) were changed, with no code modifications. There is no indication in the commit of any security fix or vulnerability.

This commit only adds Java-specific metadata options to a Solana protocol-buffer definition and regenerates the matching Rust protobuf descriptor bytes. It does not change message fields, parsing logic, or any security behavior. There is no indication of a vulnerability or security fix.

This commit fixes a small wiring mistake in how the Trezor device labels a Ripple transaction response message. The message that sends back a signed Ripple transaction was incorrectly marked as an incoming ('wire_in') message when it should be outgoing ('wire_out'). The rest of the changes are typo fixes in comments and documentation. There is no direct evidence in the commit that this caused a real security vulnerability or exploit.

This commit is purely a code-style cleanup. It adds a protobuf formatter check to the project's build tooling and reformats all .proto definition files. There are no functional changes to the firmware, no protocol changes, and no security fixes or vulnerabilities introduced.

This commit adds a GitHub Actions workflow that automatically assigns a newly opened pull request to the person who created it. It is a repository-management convenience bot with no connection to product security, cryptography, wallet operations, or firmware behavior.

This commit simply adds a new named label, VENDOR_FW_TYPE_CA, to a list of firmware types in a header file. It does not change any executable code, logic, or security behavior. It is a routine code-maintenance change with no security relevance visible in the diff.

This commit changes the Trezor command-line tool so that when a user restores a wallet with fewer than 24 words on older (legacy) Trezor devices, it automatically uses the 'advanced/matrix' recovery method instead of the default 'scrambled words' method. The scrambled method is disabled for shorter mnemonics on legacy firmware, so without this change the recovery command could fail or behave unexpectedly. It is a usability/compatibility fix rather than a fix for a vulnerability that lets an attacker steal funds.