What the developer wrote
Authored by Matt Gleason
SFT-6378: refined more comments
What changed, and why it matters
This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.
No action needed; this is a non-functional comment-only change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies comments in extmod/trezor-firmware/crypto/bip39.c within mnemonic_to_bits(). The original detailed comment explaining a prior off-by-one fix and bounds-check is replaced with a shorter comment. No C statements, control flow, loop bounds, or memory accesses are altered. The code that the comments describe remains identical.
Changed components
extmod/trezor-firmware/crypto/bip39.cInspect captured patch +2 / −3
diff --git a/extmod/trezor-firmware/crypto/bip39.c b/extmod/trezor-firmware/crypto/bip39.c
index 4d70ff8..58cce46 100644
--- a/extmod/trezor-firmware/crypto/bip39.c
+++ b/extmod/trezor-firmware/crypto/bip39.c
@@ -183,8 +183,7 @@ int mnemonic_to_bits(const char* mnemonic, uint8_t* bits) {
j = 0;
memzero(current_word, sizeof(current_word));
- // Fixed inner loop: always BIP39_MAX_WORD_LEN iterations (was -1, which
- // caused 8-char words to never set past_delim → spurious word_too_long).
+ // Always run BIP39_MAX_WORD_LEN iterations.
// Each read is bounds-checked to prevent OOB on crafted overlong input.
uint32_t past_delim = 0;
for (uint32_t ci = 0; ci < BIP39_MAX_WORD_LEN; ci++) {
@@ -201,7 +200,7 @@ int mnemonic_to_bits(const char* mnemonic, uint8_t* bits) {
i += j;
// If past_delim was never set the word overruns BIP39_MAX_WORD_LEN;
- // skip remaining characters. Valid mnemonics never take this path.
+ // skip remaining characters. Valid mnemonics never take this path.
if (!past_delim) {
word_too_long = 1;
while (i < (uint32_t)(sizeof(padded) - 1) &&
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.