ble: format pairing code without snprintf
What the developer wrote
Authored by Niklas Dusenlund
ble: format pairing code without snprintf
Write the bounded six-digit pairing code directly. This makes the range proof explicit and avoids the compiler's truncation warning.
What changed, and why it matters
This commit replaces a standard text-formatting function (snprintf) with a small hand-written loop to display a six-digit Bluetooth pairing code on the BitBox02 hardware wallet screen. The change is described by the author as a cleanup to silence a compiler warning and make the numeric bounds more obvious. There is no direct evidence in the commit that this fixes an exploitable security bug.
Treat as a benign code-quality/refactoring change. No security patch or incident response is indicated by the commit content. Normal review and regression testing of the pairing-code display path is sufficient.
Security signals we found
Replacement of variadic formatting function with explicit bounded digit loop
Buffer size is fixed and exactly matches the six-digit output plus null terminator
Input value is explicitly modulo-reduced to 0..999999 before formatting
No user-controlled length or format string is present
Evidence from the diff
The patch removes snprintf(pairing_code, sizeof(pairing_code), “%06lu”, …) and instead writes the six decimal digits of pairing_code_int directly into a 7-byte char buffer (six digits plus a null terminator already zero-initialized). The value is already bounded to 0..999999 before formatting, so both the old and new code produce a safe, fixed-length string. The change makes the range proof explicit and avoids a truncation warning from the compiler.
Changed components
src/da14531/da14531_handler.cBluetooth LE pairing code display routineInspect captured patch +4 / −1
### src/da14531/da14531_handler.c
@@ -181,7 +181,10 @@ static void _ctrl_handler(const struct da14531_ctrl_frame* frame, struct RustByt
memcpy(&pairing_code_int, &frame->cmd_data[0], sizeof(pairing_code_int));
pairing_code_int %= 1000000;
char pairing_code[7] = {0};
- snprintf(pairing_code, sizeof(pairing_code), "%06lu", (long unsigned int)pairing_code_int);
+ for (size_t i = sizeof(pairing_code) - 1; i > 0; i--) {
+ pairing_code[i - 1] = '0' + pairing_code_int % 10;
+ pairing_code_int /= 10;
+ }
// util_log("da14531: show/confirm pairing code: %s", pairing_code);
const confirm_params_t confirm_params = {
.title = "Pairing code",Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.