What the developer wrote
Authored by soralit
fix: memory issue
What changed, and why it matters
This commit fixes a coding mistake in the Ethereum batch transaction screen. The code was allocating memory for a token symbol, then accidentally assigning the result of a safe string-copy function back to the same pointer. On success, that function returns the destination pointer, so the bug is mostly harmless, but it makes the code confusing and could hide problems if the copy fails. The fix removes the redundant assignment so the pointer keeps the originally allocated memory address.
Treat as a low-risk cleanup commit. Review nearby allocation/free paths for consistent ownership and ensure strcpy_s runtime-constraint failures are handled. No urgent action required unless paired with other memory corruption findings.
Security signals we found
Memory-management hygiene fix in UI transaction-rendering path
Pointer reassignment could obscure malloc/free ownership
Located in Web3/Ethereum batch/swap transaction widget
Evidence from the diff
In GuiRenderSwapOverview(), erc20Contract->symbol is first assigned the result of malloc(), then immediately reassigned the return value of strcpy_s(). The C11 Annex K strcpy_s returns the destination pointer on success, but on runtime-constraint violation it returns a null pointer (or invokes the constraint handler) and the destination pointer value becomes indeterminate. Reassigning the pointer masks allocation ownership and complicates safe cleanup. The patch removes the assignment so only strcpy_s() is called. This is a code-quality/memory-hygiene fix rather than a demonstrated exploitable vulnerability.
Changed components
src/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.cGuiRenderSwapOverview()Ethereum batch/swap transaction overview UIInspect captured patch +1 / −1
diff --git a/src/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.c b/src/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.c
index e37e568..b174e63 100644
--- a/src/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.c
+++ b/src/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.c
@@ -691,7 +691,7 @@ static void GuiRenderSwapOverview(lv_obj_t *parent)
if (is_eth) {
erc20Contract = malloc(sizeof(Erc20Contract_t));
erc20Contract->symbol = malloc(strlen(g_currentNetwork.symbol) + 1);
- erc20Contract->symbol = strcpy_s(erc20Contract->symbol, strlen(g_currentNetwork.symbol) + 1, g_currentNetwork.symbol);
+ strcpy_s(erc20Contract->symbol, strlen(g_currentNetwork.symbol) + 1, g_currentNetwork.symbol);
erc20Contract->decimals = 18;
}
if (erc20Contract != NULL) {
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.