da14531: validate HWW BLE payload length
What the developer wrote
Authored by benma's agent
da14531: validate HWW BLE payload length
The BLE HWW path previously relied on ASSERT(payload_length == 64),
which is compiled out in release builds.
Enforce the expected USB HID report size at runtime and drop malformed
frames so usb_packet_process() never consumes stale/partial payload
bytes. Also include the headers that define USB_REPORT_SIZE and
USB_FRAME explicitly.
What changed, and why it matters
This commit fixes a bug in the Bluetooth Low Energy (BLE) handling code for the BitBox02 hardware wallet. Previously, the code assumed incoming data packets were exactly 64 bytes long, but that size check was removed in release builds. If a malformed or partial packet arrived, the device could process leftover or incorrect data. The fix adds a runtime length check and drops any packet that is not the expected size before it is passed further into the system.
Treat this as a security-hardening fix and include it in the next firmware release. Review other ASSERT-only length checks in BLE and USB paths to ensure they have runtime enforcement. Consider whether malformed frames could be triggered by an attacker and add fuzzing or boundary tests for the BLE HWW interface.
Security signals we found
Missing runtime validation of external input length
Assertion used as sole security/integrity check and compiled out in release builds
Potential processing of malformed/partial BLE frames
Fix explicitly prevents stale/partial payload consumption
Evidence from the diff
In src/da14531/da14531_handler.c, the _hww_handler() function previously used ASSERT(frame->payload_length == 64) to ensure BLE HWW frames matched the USB HID report size. Because ASSERT is compiled out in release builds, production firmware did not enforce this invariant. The patch replaces the assertion with an explicit runtime check against USB_REPORT_SIZE (defined in newly included usb/class/usb_size.h and usb/usb_frame.h), logs the error, and returns early, preventing usb_packet_process() from consuming stale or partial payload bytes.
Changed components
src/da14531/da14531_handler.cBLE HWW data pathusb_packet_process() input handlingInspect captured patch +6 / −1
diff --git a/src/da14531/da14531_handler.c b/src/da14531/da14531_handler.c
index da4b442..3d1f4fe 100644
--- a/src/da14531/da14531_handler.c
+++ b/src/da14531/da14531_handler.c
@@ -7,6 +7,8 @@
#include "memory/memory_shared.h"
#include "screen.h"
#include "ui/screen_stack.h"
+#include "usb/class/usb_size.h"
+#include "usb/usb_frame.h"
#include "usb/usb_packet.h"
#include "utils_ringbuffer.h"
#include <ui/components/confirm.h>
@@ -267,7 +269,10 @@ static void _hww_handler(struct da14531_protocol_frame* frame, struct ringbuffer
{
// util_log(" in: %s", util_dbg_hex(frame->payload, 64));
(void)queue;
- ASSERT(frame->payload_length == 64);
+ if (frame->payload_length != USB_REPORT_SIZE) {
+ util_log("da14531: invalid hww payload length %u, dropped frame", frame->payload_length);
+ return;
+ }
usb_packet_process((USB_FRAME*)&frame->payload[0]);
}
Why this scored 63/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.