ui: fix stack overflow in gui task when verifiing a bip85 mnemonic
What the developer wrote
Authored by Daniel Newton
ui: fix stack overflow in gui task when verifiing a bip85 mnemonic
What changed, and why it matters
This commit increases the stack memory given to the device's on-screen user-interface task. The change is described as fixing a 'stack overflow' that could happen while verifying a special backup phrase called a 'BIP85 mnemonic.' A stack overflow in the screen task could crash the user interface or, in the worst case, be abused to disrupt the device during a sensitive wallet operation.
Treat this as a likely security-relevant stability fix. Apply the patch, then audit the BIP85 verification code path for deep call stacks or large stack variables, add stack canaries or high-water-mark monitoring, and consider whether the overflow can be reached through attacker-controlled mnemonic input.
Security signals we found
Buffer/stack overflow class memory-safety issue
Fix located in GUI task initialization
Trigger path described as BIP85 mnemonic verification
Patch only increases stack allocation; no canary or bounds checking added
Evidence from the diff
In main/gui.c, the GUI FreeRTOS task stack size passed to xTaskCreatePinnedToCore() is raised from 3,264 bytes (31024+128) to 3,328 bytes (31024+256). The commit message states this prevents a stack overflow in gui_task during BIP85 mnemonic verification. The patch is a one-line sizing change; it does not add runtime guards, canaries, or bounds checks, so it is a partial mitigation rather than a root-cause fix.
Changed components
main/gui.cgui_task FreeRTOS taskBIP85 mnemonic verification UI flowInspect captured patch +1 / −1
diff --git a/main/gui.c b/main/gui.c
index 2be7fd0..6276172 100644
--- a/main/gui.c
+++ b/main/gui.c
@@ -289,7 +289,7 @@ void gui_init(TaskHandle_t* gui_h)
// Create (high priority) gui task
BaseType_t retval
- = xTaskCreatePinnedToCore(gui_task, "gui", 3 * 1024 + 128, NULL, JADE_TASK_PRIO_GUI, gui_h, JADE_CORE_GUI);
+ = xTaskCreatePinnedToCore(gui_task, "gui", 3 * 1024 + 256, NULL, JADE_TASK_PRIO_GUI, gui_h, JADE_CORE_GUI);
gui_task_handle = gui_h;
JADE_ASSERT_MSG(retval == pdPASS, "Failed to create GUI task, xTaskCreatePinnedToCore() returned %d", retval);
}
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.