ui: clear all displayed strings before freeing them
What the developer wrote
Authored by Jon Griffiths
ui: clear all displayed strings before freeing them
Note that UX elements that aren't explicitly cleared using the secure stack
may still be present in memory in the event of a crash, and ideally
would be added to the secure stack as needed.
What changed, and why it matters
This commit changes how the Jade hardware wallet clears text shown on screen. Previously, ordinary memory freeing could leave sensitive strings (like seed words or passphrases) sitting in RAM. Now it uses a secure wipe function before freeing. The commit itself notes this is not a complete fix, because some UI elements are not yet covered by the secure-memory mechanism.
Treat as a security-hardening fix with acknowledged gaps. Review remaining UI text allocations to ensure all sensitive strings are placed on the secure stack or wiped before deallocation. Consider whether a CVE is warranted only if an exploitable information-disclosure scenario can be demonstrated; the commit message's caveat suggests the fix is incomplete.
Security signals we found
Replacement of free() with wally_free_string() to zero sensitive text buffers
Commit message acknowledges residual risk for UI elements not on secure stack
Change targets a hardware wallet UI layer where displayed text may include secrets
Evidence from the diff
In main/gui.c, free_view_node_text_data() now calls wally_free_string() instead of free() on data->text. wally_free_string() is expected to zero the buffer before releasing it, reducing the window where sensitive display text remains in heap memory after deallocation. The commit message explicitly states that UI elements not explicitly cleared via the secure stack may still remain in memory after a crash, indicating the patch is partial.
Changed components
main/gui.cfree_view_node_text_data()wally_free_string() from libwally-coreInspect captured patch +4 / −1
diff --git a/main/gui.c b/main/gui.c
index 2b217cc..194714a 100644
--- a/main/gui.c
+++ b/main/gui.c
@@ -7,6 +7,8 @@
#include <freertos/semphr.h>
#include <freertos/task.h>
+#include <wally_core.h>
+
#include "display.h"
#include "ble/ble.h"
@@ -956,7 +958,8 @@ static void free_view_node_text_data(void* vdata)
struct view_node_text_data* data = vdata;
// free the char* that we allocated
- free(data->text);
+ // Use wally_free_string in case the text is sensitive
+ wally_free_string(data->text);
// also the scroll struct if present
if (data->scroll) {
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.