What the developer wrote
Authored by ww3512687
fix assert
What changed, and why it matters
This commit changes a password-length check from 'greater than' to 'greater than or equal to' the minimum allowed length. In the original code, a password exactly equal to the minimum length would trigger an assertion failure, which could crash the firmware or block wallet operations. The fix allows passwords of exactly the minimum length to be accepted. This is a correctness fix for an input-validation boundary condition, but the commit message gives no indication it was treated as a security issue by the vendor.
Treat as a minor bug fix. Review whether ASSERT is an appropriate mechanism for password validation (assertions may be disabled in release builds) and confirm MIN_PASSWORD_LEN is documented consistently across UI and firmware. No urgent security response is indicated by the diff alone.
Security signals we found
Boundary-condition fix in password-length validation
Use of ASSERT for input validation, which can abort execution on failure
Function involved in entropy generation for wallet seed material
Evidence from the diff
In src/managers/keystore.c, GenerateEntropy() uses ASSERT(strnlen_s(password, PASSWORD_MAX_LEN) > MIN_PASSWORD_LEN). The patch changes the comparison to >= MIN_PASSWORD_LEN. The previous strict-greater-than check incorrectly rejected passwords whose length equaled MIN_PASSWORD_LEN, causing an assertion failure. The fix aligns the assertion with the intended minimum-password policy. The change is one character and does not alter buffer handling, password hashing, or entropy generation logic.
Changed components
src/managers/keystore.cGenerateEntropy()Inspect captured patch +1 / −1
diff --git a/src/managers/keystore.c b/src/managers/keystore.c
index fab66b7..e456b00 100644
--- a/src/managers/keystore.c
+++ b/src/managers/keystore.c
@@ -57,7 +57,7 @@ int32_t GenerateEntropy(uint8_t *entropy, uint8_t entropyLen, const char *passwo
{
uint8_t randomBuffer[ENTROPY_MAX_LEN], inputBuffer[ENTROPY_MAX_LEN], outputBuffer[ENTROPY_MAX_LEN];
int32_t ret;
- ASSERT(strnlen_s(password, PASSWORD_MAX_LEN) > MIN_PASSWORD_LEN);
+ ASSERT(strnlen_s(password, PASSWORD_MAX_LEN) >= MIN_PASSWORD_LEN);
do {
HashWithSalt(inputBuffer, (uint8_t *)password, strnlen_s(password, PASSWORD_MAX_LEN), "generate entropy");
Why this scored 39/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.