What the developer wrote
Authored by benma's agent
u2f: fix refresh screen
What changed, and why it matters
This commit fixes a UI cleanup bug in the BitBox02 hardware wallet's U2F (Universal 2nd Factor) feature. Previously, a 'Refresh webpage' screen could be destroyed without clearing the pointer that tracked it, potentially leaving a dangling reference. The patch adds a custom cleanup handler that nulls out the pointer when the screen is removed. There is no direct evidence in the commit of a security exploit, but use-after-free or dangling-pointer bugs in firmware can sometimes have security implications if they lead to crashes or memory corruption.
Treat as a routine bug fix with potential defensive-security value. No immediate incident response is warranted based on this commit alone. If auditing, verify that all other component pointers in _state are similarly nullified on cleanup and that no other U2F or UI code paths dereference _state.refresh_webpage without a NULL check.
Security signals we found
dangling-pointer mitigation
use-after-free prevention
firmware UI state cleanup
no explicit security claim in commit message
Evidence from the diff
The change modifies src/u2f.c to wrap the ‘Refresh webpage’ info component with a custom component_functions_t structure. The custom cleanup callback _refresh_webpage_cleanup() calls ui_util_component_cleanup() and additionally sets _state.refresh_webpage to NULL if the cleaned-up component matches the stored pointer. This prevents a dangling pointer scenario where _state.refresh_webpage continues to reference a freed/destroyed component. The commit message and diff do not describe any exploit, CVE, or security impact.
Changed components
src/u2f.cU2F refresh webpage screen_state.refresh_webpage component pointerInspect captured patch +17 / −1
diff --git a/src/u2f.c b/src/u2f.c
index 45ed22e..45aa6a1 100644
--- a/src/u2f.c
+++ b/src/u2f.c
@@ -107,9 +107,25 @@ typedef struct __attribute__((__packed__)) {
#pragma GCC diagnostic pop
+static void _refresh_webpage_cleanup(component_t* component)
+{
+ if (_state.refresh_webpage == component) {
+ _state.refresh_webpage = NULL;
+ }
+ ui_util_component_cleanup(component);
+}
+
+static const component_functions_t _refresh_webpage_component_functions = {
+ .cleanup = _refresh_webpage_cleanup,
+ .render = ui_util_component_render_subcomponents,
+ .on_event = NULL,
+};
+
static component_t* _create_refresh_webpage(void)
{
- return info_centered_create("Refresh webpage", NULL);
+ component_t* component = info_centered_create("Refresh webpage", NULL);
+ component->f = &_refresh_webpage_component_functions;
+ return component;
}
/* Resets the internal state to idle. */
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.