What the developer wrote
Authored by Marko Bencun
bootloader: allow full sized images
The erase call disallowed full sized firmware images.
What changed, and why it matters
This commit fixes a bootloader bug where the device rejected firmware updates that used the maximum allowed size. The off-by-one check meant legitimate full-sized firmware images could not be installed, potentially blocking updates. The fix changes the limit from 'one less than maximum' to 'maximum'. There is no direct evidence this was exploitable as an attack, but any bug in firmware-update verification deserves attention.
Treat as a routine bootloader bugfix with low-to-moderate security relevance. Review whether the off-by-one could have interacted with other update-path checks (e.g., signature verification, chunk size, total length) and confirm the maximum chunk count now matches the documented firmware slot size. No urgent incident response is indicated from the diff alone.
Security signals we found
Off-by-one input validation in firmware-update path
Bootloader change affecting firmware chunk count acceptance
CHANGELOG labels the change as a bugfix for full-sized firmware upgrades
Evidence from the diff
In src/bootloader/bootloader.c, _api_firmware_erase() validates the number of firmware chunks before erasing flash for an update. The original check rejected firmware_num_chunks > FIRMWARE_MAX_NUM_CHUNKS - 1, which incorrectly treated the maximum chunk count as too large. The patch changes the bound to firmware_num_chunks > FIRMWARE_MAX_NUM_CHUNKS, allowing a full-size image. This is an off-by-one error in input validation. The CHANGELOG records it as a bootloader bugfix and bumps the bootloader version from v1.2.0 to v1.2.1.
Changed components
BitBox02 bootloadersrc/bootloader/bootloader.cfirmware update/erase APIInspect captured patch +5 / −3
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9d718a4..cb76a8f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -202,10 +202,12 @@ customers cannot upgrade their bootloader, its changes are recorded separately.
## Bootloader
+### v1.2.1
+- Bugfix to allow full-sized firmware upgrades
+
### v1.2.0
- Convert to stage1
- Security improvements
-- Bugfix to allow full-sized firmware upgrades
### v1.1.2
- BitBox02 Nova: correctly orient bootloader screen
diff --git a/src/bootloader/bootloader.c b/src/bootloader/bootloader.c
index 69743f4..c4df93f 100644
--- a/src/bootloader/bootloader.c
+++ b/src/bootloader/bootloader.c
@@ -442,7 +442,7 @@ static size_t _api_write_chunk(const uint8_t* buf, uint8_t chunknum, uint8_t* ou
*/
static size_t _api_firmware_erase(uint8_t firmware_num_chunks, uint8_t* output)
{
- if (firmware_num_chunks > FIRMWARE_MAX_NUM_CHUNKS - 1) {
+ if (firmware_num_chunks > FIRMWARE_MAX_NUM_CHUNKS) {
return _report_status(OP_STATUS_ERR_LEN, output);
}
if (firmware_num_chunks > 0) {
diff --git a/versions.json b/versions.json
index 9290571..4e95f07 100644
--- a/versions.json
+++ b/versions.json
@@ -1,5 +1,5 @@
{
"firmware": "v9.26.2",
- "bootloader": "v1.2.0",
+ "bootloader": "v1.2.1",
"stage0": 1
}
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.