What the developer wrote
Authored by ww3512687
connect wallet crash
What changed, and why it matters
This commit fixes a software crash in the wallet connection screen of the Keystone 3 hardware wallet firmware. The code now checks whether a selected coin/wallet type was found before continuing. Without this check, the device could crash when connecting to a wallet it does not recognize, likely causing a denial of service rather than theft of funds.
Treat as a low-severity stability/security hardening fix. Verify that other similar lookup functions in the UI layer also handle missing entries. No immediate emergency response is warranted unless the crash can be triggered remotely or during a sensitive transaction flow.
Security signals we found
Null-pointer dereference crash fixed
UI/wallet-connect denial-of-service vector
Missing bounds/lookup failure handling
Evidence from the diff
In SetWallet(), a loop searches a table for a matching wallet/coin entry. Previously, if no match was found, coin remained NULL and the function continued to dereference it (e.g., coin->name). The patch adds a NULL check and early return, preventing a null-pointer dereference crash in the UI status bar component during wallet connection flows.
Changed components
src/ui/gui_components/gui_status_bar.cWallet connection UI flowInspect captured patch +3 / −0
diff --git a/src/ui/gui_components/gui_status_bar.c b/src/ui/gui_components/gui_status_bar.c
index 9f045c8..793f129 100644
--- a/src/ui/gui_components/gui_status_bar.c
+++ b/src/ui/gui_components/gui_status_bar.c
@@ -755,6 +755,9 @@ void SetWallet(NavBarWidget_t *navBarWidget, WALLET_LIST_INDEX_ENUM index, const
break;
}
}
+ if (coin == NULL) {
+ return;
+ }
if (name == NULL) {
char nameBuf[BUFFER_SIZE_64] = {0};
Why this scored 36/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.