Trezor firmware

This commit simply removes two unused header file includes from source files in the secure AES module. It is a routine cleanup with no functional code changes and no security relevance.

This commit fixes a small but real bug in the Python Trezor library's handling of USB/transport messages. When reassembling a multi-part message, if a follow-up chunk had a malformed header, the code would crash with a low-level Python struct.error instead of raising a proper ProtocolError. The fix wraps that parsing in a try/except and raises a clean ProtocolError with a clear message. It also slightly improves the error message for an invalid initial header.

This commit only changes a test helper file to print a warning message when a Trezor device connection fails during automated testing. It does not modify the actual firmware, wallet logic, cryptography, or any user-facing security behavior. There is no security issue here.

This commit fixes a bug in the Python Trezor library's handling of multi-part USB messages. When a message is split into several chunks, some middle chunks could be skipped or arrive out of order, causing the library to misread the message or fail. The fix makes the receiver more tolerant: it skips unexpected continuation packets and re-synchronizes when a new message starts in the middle of an expected stream. This is a reliability fix in the host-side Python code, not the hardware wallet firmware itself, and it does not appear to be a direct exploit for stealing coins.

This commit is a hardening change, not a vulnerability fix. It pins all GitHub Actions used by Trezor's firmware build and test pipelines to specific commit hashes instead of version tags, and updates those actions to their latest released versions. Pinning prevents a compromised action publisher from silently replacing a trusted tag with malicious code. There is no evidence of an actual supply-chain attack or any bug being fixed beyond this preventive measure.

This commit only changes the test code for the Trezor firmware. It fixes how debug logging is suppressed during unit tests by moving the suppression logic into the shared test runner, instead of having each test file call a helper function. There is no change to the actual wallet firmware that users rely on, and no security vulnerability is being fixed.

This commit fixes a trivial formatting issue in a GitHub Actions workflow file by adding a missing space before two inline comments. It has no security relevance.

This commit fixes a small cleanup bug in the code that creates Ed25519 digital signatures in Trezor hardware wallets. When a certain rare mathematical check fails, the function now securely wipes two temporary secret values from memory before returning an error. Without the fix, those temporary secrets could remain in memory longer than intended. This is a defense-in-depth improvement rather than a confirmed exploitable vulnerability.

This commit fixes a cleanup issue in the code that creates cryptocurrency signatures on Trezor hardware wallets. In several error paths, secret intermediate numbers (including a copy of the private key and random nonce values) were left in memory instead of being securely erased. The patch makes sure those values are wiped even when the function exits early due to an invalid key or other failure. This reduces the risk that sensitive signing material could leak if memory is later read by another process or attacker.

This commit fixes a bug in the Cardano cryptocurrency key derivation code for Trezor hardware wallets. Previously, if a certain error path was hit during key derivation, the function would return early without wiping sensitive intermediate values from memory. The fix ensures those temporary secrets are always cleared, even when the function fails partway through. It also adds cleanup for a couple of additional temporary buffers that were not being wiped before.

This commit fixes a cleanup oversight in the Trezor firmware's code that handles NEM cryptocurrency encryption and decryption. Previously, if an encryption or decryption operation failed partway through, the temporary AES key context (a small chunk of memory holding sensitive key material) was not securely wiped before the function returned. The patch ensures this memory is always zeroed out, even on error paths, reducing the risk that leftover cryptographic key bits could leak to other code or be recovered later. It is a defensive hardening fix rather than a demonstrated exploitable bug.

This commit is a routine version number update. It changes patch version numbers from 2.11.0 to 2.11.1 for the modern Trezor firmware and from 1.14.1 to 1.14.2 for the legacy firmware, updates matching translation file headers, and refreshes a translation signature file. There are no code logic changes, no bug fixes, and no security-related modifications visible in the diff.

This commit is a routine user-interface fix for the Trezor hardware wallet's 'Caesar' layout. It swaps a hard-coded English string ('Locking the device...') for a localizable translation key and slightly increases the on-screen margin so longer translated text fits. The remaining changes are only updated test screenshot fingerprints, which is expected when any visible text changes. There is no security issue here.

This commit fixes a hard-coded error message sent by Trezor devices when an older protocol (v1) is used on a connection that expects the newer THP protocol. The message's length field was wrong (claimed 20 bytes instead of 2), which could cause the receiving host to read extra, unintended bytes. The fix corrects the length and adds a test to ensure the response is exactly the right size.

This commit is a routine internal cleanup of the project's GitHub Actions CI workflow. It refactors a workflow that generates UI screenshots for translators so it can run for either one selected language or all supported languages. There is no change to the Trezor firmware code, device behavior, secrets handling, or user-facing functionality.

This commit only updates a list of automated test cases in a text file. It removes two PIN-related tests and adds seventeen tests covering wallet reset and recovery scenarios. There are no code changes to the firmware or any user-facing behavior.

This commit fixes a potential integer overflow bug in the Trezor hardware wallet's kernel syscall verifier. The verifier checks whether a graphics operation's source or destination memory region is accessible before allowing it. Previously, the multiplication of stride (row byte length) by height (number of rows) was done using the original integer types, which could overflow and produce a smaller value than the actual memory region size. That could let a malicious or buggy userspace app pass the access check while reading or writing memory outside its allowed area. The fix forces the multiplication to use size_t, a wider type, so the calculated region size is accurate on 32-bit STM32 hardware.

This commit fixes a security weakness in the Trezor hardware wallet's JPEG decoder system call. Before the fix, the kernel did not fully check that the image data pointer and remaining data length were safe for the unprivileged app to access. A malformed request could potentially read memory outside the allowed buffer, which on this secure chip architecture could leak secrets or crash the device. The patch adds explicit bounds checks and confirms the app actually has read permission to the memory region it references.

This commit fixes a security boundary check in the Trezor firmware's system-call verifier. The old code trusted a user-supplied string pointer and measured its length with strlen(), which can read beyond allowed memory if the string is malformed or malicious. The fix makes the caller provide the string length explicitly and checks exactly that many bytes. This closes a likely path for a restricted app to trick the device into reading memory it shouldn't, potentially causing a crash or leaking secrets.

This commit fixes a function that reads translated text data from the hardware wallet's flash storage. Previously, if a caller requested data starting at an offset beyond the end of the translation area, the function would calculate a negative-looking length (because unsigned arithmetic wraps around) and return a pointer to an invalid memory location. The fix checks whether the offset is too large and returns NULL instead. This could have allowed malformed or attacker-controlled data to trick the device into reading memory outside the intended translation area, potentially causing crashes or exposing unrelated flash contents.

This commit changes two system call handlers in Trezor's firmware so that translation-related read/write operations go through 'verified' versions of functions. The change suggests the previous unverified versions may have allowed untrusted code (apps running on the device) to access or modify translation data in unsafe ways, such as passing bad memory pointers or lengths. Without the verified wrapper, a malicious or buggy app could potentially corrupt memory or read/write data it should not. The patch is very small and does not show the verifier code itself, so we cannot confirm the exact bug or exploit path.

This commit is a straightforward code cleanup: it renames functions like flash_configure_option_bytes() to option_bytes_configure() and check_oem_keys() to option_bytes_check_oem_keys(), makes several internal helpers static (visible only within one file), and changes the compile-time guard from KERNEL_MODE to SECURE_MODE. The actual logic that checks and writes the chip's security option bytes is unchanged. There is no indication this fixes a security bug or introduces a vulnerability.

This commit changes build configuration files for several Trezor hardware wallet models so that a special debug helper file for physical buttons is included only when the 'usb_iface_debug' feature is requested. It does not change user-facing behavior in normal production builds. The change appears to be a build-system cleanup to make debug-only button code compile correctly on button-based devices, not a fix for an active security vulnerability.

This commit adds a debug-only feature that lets software simulate physical button presses (press, release, click) on Trezor hardware wallets. It is compiled in only when the DEBUGLINK build flag is set, which is intended for development and automated testing, not production firmware. The feature could let a connected debugging host or test harness inject fake button events into the normal button-handling path.

This commit adds a debug-only feature to the Trezor hardware wallet firmware that lets developers inject fake touch-screen events (taps, swipes, clicks) into the touch driver. It is gated behind the DEBUGLINK build flag, which is used only in development/testing builds, not in production firmware shipped to users. The change itself is a feature implementation; there is no direct evidence in the commit that it fixes a security bug or that it introduces an exploitable vulnerability in production devices.