jadepy: return empty bytes if asked to read 0 bytes
What the developer wrote
Authored by Jon Griffiths
jadepy: return empty bytes if asked to read 0 bytes
The CBOR parser appears to ask for 0 bytes when parsing on occasion.
What changed, and why it matters
This is a small bug-fix in the Python library that talks to Blockstream Jade hardware wallets. When the code was asked to read zero bytes, it previously passed that request straight to the underlying transport, which could misbehave or return unexpected results. The fix makes it return an empty response immediately instead. It is a robustness improvement rather than a clear security vulnerability.
Treat as a routine robustness fix. Review whether the CBOR parser's zero-byte reads indicate a deeper serialization issue, and ensure downstream callers handle empty reads consistently. No urgent security response is indicated by this commit alone.
Security signals we found
Defensive null/zero-length input handling
Potential parser robustness issue (CBOR read of 0 bytes)
No explicit security claim in commit message
Evidence from the diff
In jadepy/jade.py, JadeInterface.read() now returns bytes() when n is 0 instead of calling self.impl.read(0). Some underlying stream implementations return None, block, or raise when asked to read 0 bytes, and the CBOR parser apparently triggers such calls. The change prevents downstream parsing from receiving an unexpected value. There is no evidence in the commit of an exploitable memory-corruption, authentication bypass, or confidentiality issue.
Changed components
jadepy/jade.py:JadeInterface.read()Inspect captured patch +1 / −1
diff --git a/jadepy/jade.py b/jadepy/jade.py
index 3240f8f..78691f1 100644
--- a/jadepy/jade.py
+++ b/jadepy/jade.py
@@ -2313,7 +2313,7 @@ class JadeInterface:
The bytes received
"""
# logger.debug(f'Reading {n} bytes...')
- bytes_ = self.impl.read(n)
+ bytes_ = self.impl.read(n) if n else bytes()
# logger.debug(f'Received: {len(bytes_)} bytes')
return bytes_
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.