What the developer wrote
Authored by Mike Tolkachev
qrmode: clean temporary buffer
What changed, and why it matters
This commit adds cleanup of a temporary memory buffer used when turning data into QR codes on the Blockstream Jade hardware wallet. The buffer could previously remain in memory after use, potentially leaving sensitive QR data behind for later code to read. The fix marks the buffer as sensitive and securely clears it after use.
Review other stack and heap work buffers in qrmode.c and related modules to ensure all temporary buffers handling sensitive data are similarly protected with SENSITIVE_PUSH/SENSITIVE_POP or equivalent secure-clear mechanisms. Verify that SENSITIVE_POP is implemented correctly and is not optimized away by the compiler.
Security signals we found
Sensitive temporary buffer not cleared before fix
Use of SENSITIVE_PUSH/SENSITIVE_POP memory-clearing macros
QR payload data may include private or confidential material
Stack-local work area with potential residual data exposure
Evidence from the diff
In main/qrmode.c, bytes_to_qr_icon() uses a 256-byte stack buffer (qrbuffer) as a work area for the qrcode_initBytes() function. The commit wraps the buffer with SENSITIVE_PUSH and SENSITIVE_POP macros, which typically mark the memory as sensitive and ensure it is zeroed/cleared when the scope exits. Without this, residual QR payload data could remain in the stack buffer after the function returns, creating an information-disclosure risk if that stack region is later reused or inspected.
Changed components
main/qrmode.cbytes_to_qr_icon()QR code generation pathInspect captured patch +2 / −0
### main/qrmode.c
@@ -1349,11 +1349,13 @@ static void bytes_to_qr_icon(const uint8_t* bytes, const size_t bytes_len, Icon*
// Convert url to qr code, then to Icon
QRCode qrcode;
uint8_t qrbuffer[256]; // opaque work area
+ SENSITIVE_PUSH(qrbuffer, sizeof(qrbuffer));
JADE_ASSERT(qrcode_getBufferSize(qr_version) <= sizeof(qrbuffer));
const int qret = qrcode_initBytes(&qrcode, qrbuffer, qr_version, ECC_LOW, (uint8_t*)bytes, bytes_len);
JADE_ASSERT(qret == 0);
qrcode_toIcon(&qrcode, qr_icon, scale_factor);
+ SENSITIVE_POP(qrbuffer);
}
// Display a BC-UR bytes messageWhy this scored 36/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.