Merge pull request #686 from Foundation-Devices/fix/ecdsa-binding-length-checks

### extmod/trezor-firmware/core/embed/extmod/modtrezorcrypto/modtrezorcrypto-ecdsa.h
@@ -44,6 +44,12 @@ STATIC mp_obj_t mod_trezorcrypto_ecdsa_scalar_multiply(mp_obj_t k_obj) {
     mp_buffer_info_t k_buf;
     mp_get_buffer_raise(k_obj, &k_buf, MP_BUFFER_READ);
 
+    // bn_read_be() always reads 32 bytes, so reject anything else rather than
+    // reading past the end of the buffer.
+    if (k_buf.len != 32) {
+        mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of scalar"));
+    }
+
     // Convert k to a bignum
     bignum256 k;
     bn_read_be((uint8_t *)k_buf.buf, &k);
@@ -94,6 +100,21 @@ STATIC mp_obj_t mod_trezorcrypto_ecdsa_point_add(size_t n_args, const mp_obj_t *
     mp_buffer_info_t y2_buf;
     mp_get_buffer_raise(args[3], &y2_buf, MP_BUFFER_READ);
 
+    // bn_read_be() always reads 32 bytes from each coordinate, so reject any
+    // other length rather than reading past the end of the buffer.
+    if (x1_buf.len != 32) {
+        mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of x1"));
+    }
+    if (y1_buf.len != 32) {
+        mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of y1"));
+    }
+    if (x2_buf.len != 32) {
+        mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of x2"));
+    }
+    if (y2_buf.len != 32) {
+        mp_raise_ValueError(MP_ERROR_TEXT("Invalid length of y2"));
+    }
+
     // Convert coordinates to bignums
     bn_read_be((uint8_t *)x1_buf.buf, &p1.x);
     bn_read_be((uint8_t *)y1_buf.buf, &p1.y);

### ports/stm32/boards/Passport/modules/tests/test_unit.py
@@ -20,6 +20,10 @@ def test_error_codes(test):
     assert test('error_codes.py') == b'OK'
 
 
+def test_ecdsa_bindings(test):
+    assert test('ecdsa_bindings.py') == b'OK'
+
+
 def test_ext_settings(test):
     assert test('ext_settings.py') == b'OK'
 

### ports/stm32/boards/Passport/modules/tests/unit/ecdsa_bindings.py
@@ -0,0 +1,61 @@
+# SPDX-FileCopyrightText: © 2026 Foundation Devices, Inc. <hello@foundation.xyz>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Buffer length validation in the trezorcrypto.ecdsa bindings. bn_read_be()
+# always reads 32 bytes, so a shorter buffer would read past its end.
+
+from trezorcrypto import ecdsa
+from ubinascii import unhexlify as a2b_hex
+
+
+GENERATOR_X = a2b_hex('79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798')
+GENERATOR_Y = a2b_hex('483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8')
+
+BAD_LENGTHS = (
+    b'',
+    b'\x01',
+    b'\x01' * 31,
+    b'\x01' * 33,
+    b'\x01' * 64,
+)
+
+
+def scalar(value):
+    return bytes(31) + bytes([value])
+
+
+def must_reject(call):
+    try:
+        call()
+    except ValueError:
+        return
+
+    raise RuntimeError('expected ValueError')
+
+
+# Valid operations still work: 1 * G is the generator.
+x1, y1 = ecdsa.scalar_multiply(scalar(1))
+assert x1 == GENERATOR_X
+assert y1 == GENERATOR_Y
+
+# G + 2G == 3G, checked against scalar_multiply so the vector does not depend on
+# a hardcoded point. The two addends differ, so this is not the doubling case.
+x2, y2 = ecdsa.scalar_multiply(scalar(2))
+x3, y3 = ecdsa.scalar_multiply(scalar(3))
+assert ecdsa.point_add(x1, y1, x2, y2) == (x3, y3)
+
+# Every scalar length other than 32 is rejected.
+for bad in BAD_LENGTHS:
+    must_reject(lambda: ecdsa.scalar_multiply(bad))
+
+# ...and every coordinate of point_add, in each position.
+for bad in BAD_LENGTHS:
+    must_reject(lambda: ecdsa.point_add(bad, y1, x2, y2))
+    must_reject(lambda: ecdsa.point_add(x1, bad, x2, y2))
+    must_reject(lambda: ecdsa.point_add(x1, y1, bad, y2))
+    must_reject(lambda: ecdsa.point_add(x1, y1, x2, bad))
+
+# A rejected call must not have disturbed the valid path.
+assert ecdsa.point_add(x1, y1, x2, y2) == (x3, y3)
+
+return_value.write(b'OK')