What the developer wrote
Authored by ww3512687
fix ton crash
What changed, and why it matters
This commit fixes a crash in the TON (The Open Network) signing code for the Keystone 3 hardware wallet. Previously, if a user had not set a custom derivation path, the code would blindly copy the seed bytes into a fixed 32-byte secret key buffer. If the seed was shorter than 32 bytes, this would read past the end of the seed data, causing a crash or undefined behavior. The fix checks the seed length first and returns a controlled error if it is too short.
Treat as a low-to-moderate reliability/security fix. Review whether other signing modules use similar unguarded copy_from_slice patterns with seed or key buffers. Ensure seed generation/derivation always produces at least 32 bytes, and add regression tests for short-seed handling in the TON signing path.
Security signals we found
Missing input length validation on seed buffer before copy_from_slice
Potential panic/crash in cryptographic signing path
Fix is in TON signing Rust FFI code
Patch adds explicit minimum-length check and bounded copy
Evidence from the diff
In rust/rust_c/src/ton/mod.rs, get_secret_key() handles two cases: a provided derivation path (which derives a 32-byte secret key) and no derivation path (which previously called sk.copy_from_slice(seed)). copy_from_slice requires both slices to have the same length. sk is [u8; 32]. If seed.len() < 32, this panics in Rust (slice length mismatch). If seed.len() > 32, only the first 32 bytes are copied in the fixed-size destination, but the previous code did not enforce this either. The patch adds an explicit length check and copies only seed[0..32], preventing a panic/undefined behavior when seed is shorter than 32 bytes. The crash is most likely a Rust panic from copy_from_slice length mismatch, not a memory-safety overflow in the C sense, but it is still a denial-of-service condition for signing operations.
Changed components
rust/rust_c/src/ton/mod.rsTON signing request handlerget_secret_key functionInspect captured patch +6 / −1
diff --git a/rust/rust_c/src/ton/mod.rs b/rust/rust_c/src/ton/mod.rs
index 07bfee7..2d49f19 100644
--- a/rust/rust_c/src/ton/mod.rs
+++ b/rust/rust_c/src/ton/mod.rs
@@ -113,7 +113,12 @@ fn get_secret_key(tx: &TonSignRequest, seed: &[u8]) -> Result<[u8; 32], RustCErr
Err(e) => return Err(RustCError::UnexpectedError(e.to_string())),
}
}
- None => sk.copy_from_slice(seed),
+ None => {
+ if seed.len() < 32 {
+ return Err(RustCError::InvalidData("Seed too short".to_string()));
+ }
+ sk.copy_from_slice(&seed[0..32]);
+ }
};
Ok(sk)
}
Why this scored 59/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.