factorysetup: validate RTT message length
What the developer wrote
Authored by benma's agent
factorysetup: validate RTT message length
Reject RTT frames whose declared payload exceeds the bytes returned by the transport.
This prevents copying uninitialized stack data into factory commands when a frame is partial.
What changed, and why it matters
This commit fixes a bug in the BitBox02 factory setup tool that receives debug messages over SEGGER RTT. Previously, if a message said it contained more bytes than were actually received, the code would copy whatever leftover data happened to be sitting in a stack buffer into a factory command. That could leak uninitialized memory or cause the device to act on garbage data. The fix adds a simple length check and rejects incomplete frames.
Treat as a security hardening fix for the factory setup tooling. No independent CVE is required unless the vendor requests one; ensure factory flashing workflows use firmware containing this commit.
Security signals we found
Copy of uninitialized stack data into command buffer (information disclosure / undefined behavior)
Missing length validation against actual bytes received
Factory-only code path (factorysetup), not normal user firmware operation
Evidence from the diff
In src/factorysetup.c, _rtt_receive() reads an RTT frame into a stack buffer, parses a 2-byte length prefix (LENSIZE), and then copies len bytes from buffer+LENSIZE into msg_out. Before the patch, len was validated only against a maximum size, not against the actual number of bytes read. If len > read - LENSIZE, memcpy would read beyond the valid payload into uninitialized stack memory. The patch adds the missing bounds check and returns false for incomplete frames.
Changed components
src/factorysetup.c:_rtt_receive()Inspect captured patch +5 / −0
diff --git a/src/factorysetup.c b/src/factorysetup.c
index be591eb..7a3c6ab 100644
--- a/src/factorysetup.c
+++ b/src/factorysetup.c
@@ -880,6 +880,11 @@ static bool _rtt_receive(uint8_t* msg_out, size_t* len_out)
screen_print_debug_hex(buffer, read, 5000);
return false;
}
+ if ((size_t)len > (size_t)read - LENSIZE) {
+ screen_sprintf_debug(
+ 2000, "Error: incomplete message: %d bytes (total read: %d)", len, read);
+ return false;
+ }
*len_out = (size_t)len;
memcpy(msg_out, buffer + LENSIZE, (size_t)len);
return true;
Why this scored 60/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.