cbor: avoid passing null to memcpy with len 0 in tinycbor
What the developer wrote
Authored by Jon Griffiths
cbor: avoid passing null to memcpy with len 0 in tinycbor
Found by asan.
What changed, and why it matters
This commit fixes a low-level memory-handling issue in Blockstream Jade's CBOR encoding helper. When adding an empty byte string to a data map, the code previously could pass a null pointer to a memory-copy routine. The fix substitutes a dummy non-null pointer when the data length is zero, avoiding undefined behavior detected by AddressSanitizer. It is a defensive hardening change rather than a confirmed exploitable vulnerability.
Treat as a hardening fix. Merge the patch and consider whether the same pattern exists elsewhere when encoding zero-length byte strings. No immediate incident response is warranted absent evidence of exploitable behavior beyond the undefined-behavior sanitizer finding.
Security signals we found
Null pointer passed to memcpy-like routine with zero length (undefined behavior)
Fix gated by CONFIG_LIBJADE build flag
Detected by AddressSanitizer (asan)
Defensive hardening in CBOR RPC serialization path
Evidence from the diff
In main/utils/cbor_rpc.c, add_bytes_to_map() calls cbor_encode_byte_string() from tinycbor. When len is 0, value may be NULL, and tinycbor’s internal memcpy(src, dst, 0) with a null source pointer is undefined behavior even though zero bytes are copied. The patch, active only under CONFIG_LIBJADE, passes a pointer to a local dummy byte instead of value when len == 0. This resolves an AddressSanitizer finding. The change is localized and does not alter protocol behavior or output.
Changed components
main/utils/cbor_rpc.cadd_bytes_to_map()tinycbor cbor_encode_byte_string integrationInspect captured patch +6 / −0
diff --git a/main/utils/cbor_rpc.c b/main/utils/cbor_rpc.c
index baef8b6..8dcf6b1 100644
--- a/main/utils/cbor_rpc.c
+++ b/main/utils/cbor_rpc.c
@@ -673,7 +673,13 @@ void add_bytes_to_map(CborEncoder* container, const char* name, const uint8_t* v
CborError cberr = cbor_encode_text_stringz(container, name);
JADE_ASSERT(cberr == CborNoError);
+#ifdef CONFIG_LIBJADE
+ // Prevent passing null to memcpy with len 0 in tinycbor
+ const uint8_t dummy = 0;
+ cberr = cbor_encode_byte_string(container, len ? value : &dummy, len);
+#else
cberr = cbor_encode_byte_string(container, value, len);
+#endif
JADE_ASSERT(cberr == CborNoError);
}
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.