Use string literals for format strings
What the developer wrote
Authored by Greg Pfeil
Use string literals for format strings
I couldn’t get the simulator to compile without making these changes.
This is on macOS Tahoe with Clang 19.1.7.
```
/…/src/ui/gui_widgets/gui_firmware_update_widgets.c:119:51: error: format string is not a string literal (potentially insecure) [-Werror,-Wformat-security]
119 | lv_label_set_text_fmt(g_calCheckSumLabel, _("firmware_update_sd_checksum_desc"));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/…/src/ui/gui_widgets/gui_firmware_update_widgets.c:119:51: note: treat the string as an argument to avoid this
119 | lv_label_set_text_fmt(g_calCheckSumLabel, _("firmware_update_sd_checksum_desc"));
| ^
| "%s",
```
Alternatively, the warning could be disabled, but I don’t like doing
that and this change seemed trivial.
What changed, and why it matters
This commit fixes compile errors triggered by a stricter compiler setting that treats non-literal format strings as potentially insecure. The changes wrap translated UI text strings with a safe "%s" placeholder so they are treated as plain text rather than format strings. In theory, the old code could have allowed a malicious or malformed translation string to be interpreted as a format specifier, possibly causing crashes or information leaks, but there is no evidence that any such attack was possible or exploited in practice. The commit message frames the change as a build fix, not a security fix.
Treat as a low-risk defensive hardening commit. Review whether translation files are trusted inputs and consider enabling -Wformat-security in CI if not already enforced. The unrelated device_setting.h include should be verified for correctness.
Security signals we found
Format-string hardening: translated strings now passed as "%s" arguments
Compiler security flag -Wformat-security triggered the change
No vendor disclosure of security relevance
No CVE or advisory referenced
Change motivated by build failure, not incident response
Evidence from the diff
The patch converts several calls to snprintf_s and lv_label_set_text_fmt so that the translated string returned by _() is passed as an argument via “%s” instead of being used directly as the format string. This addresses -Wformat-security warnings treated as errors. The change is defensive: if a translation resource ever contained format specifiers (e.g., %s, %n), the previous code could have read or written unintended memory. The additional #include “device_setting.h” in gui_keyboard.c is unrelated to the format-string issue and its purpose is not explained in the commit.
Changed components
src/ui/gui_chain/multi/web3/gui_ada.csrc/ui/gui_components/gui_keyboard.csrc/ui/gui_widgets/gui_firmware_update_widgets.csrc/ui/gui_widgets/gui_utxo_receive_widgets.csrc/ui/gui_widgets/multi/gui_change_path_type_widgets.csrc/ui/gui_widgets/multi/web3/gui_multi_path_coin_receive_widgets.cInspect captured patch +11 / −10
diff --git a/src/ui/gui_chain/multi/web3/gui_ada.c b/src/ui/gui_chain/multi/web3/gui_ada.c
index 3009ff6..7d0d29f 100644
--- a/src/ui/gui_chain/multi/web3/gui_ada.c
+++ b/src/ui/gui_chain/multi/web3/gui_ada.c
@@ -532,7 +532,7 @@ bool GetAdaVotingProposalsExist(void *indata, void *param)
void GetAdaVotingProposalsLabel(void *indata, void *param, uint32_t maxLen)
{
- snprintf_s((char *)indata, maxLen, _("ada_proposals_tx_notice"));
+ snprintf_s((char *)indata, maxLen, "%s", _("ada_proposals_tx_notice"));
}
void GetAdaVotingProceduresSize(uint16_t *width, uint16_t *height, void *param)
diff --git a/src/ui/gui_components/gui_keyboard.c b/src/ui/gui_components/gui_keyboard.c
index 26c6d21..b50875e 100644
--- a/src/ui/gui_components/gui_keyboard.c
+++ b/src/ui/gui_components/gui_keyboard.c
@@ -1,4 +1,5 @@
#include <string.h>
+#include "device_setting.h"
#include "motor_manager.h"
#include "gui.h"
#include "gui_obj.h"
diff --git a/src/ui/gui_widgets/gui_firmware_update_widgets.c b/src/ui/gui_widgets/gui_firmware_update_widgets.c
index e0cb50b..c640c06 100644
--- a/src/ui/gui_widgets/gui_firmware_update_widgets.c
+++ b/src/ui/gui_widgets/gui_firmware_update_widgets.c
@@ -116,7 +116,7 @@ void GuiCreateSdCardUpdateHintbox(bool checkSumDone)
lv_obj_set_size(btn, 250, 50);
lv_obj_align(btn, LV_ALIGN_BOTTOM_LEFT, 36, -120);
lv_obj_add_event_cb(btn, FirmwareSdcardCheckSha256HintBoxHandler, LV_EVENT_CLICKED, NULL);
- lv_label_set_text_fmt(g_calCheckSumLabel, _("firmware_update_sd_checksum_desc"));
+ lv_label_set_text_fmt(g_calCheckSumLabel, "%s", _("firmware_update_sd_checksum_desc"));
}
}
diff --git a/src/ui/gui_widgets/gui_utxo_receive_widgets.c b/src/ui/gui_widgets/gui_utxo_receive_widgets.c
index 60ca88d..2d27a64 100644
--- a/src/ui/gui_widgets/gui_utxo_receive_widgets.c
+++ b/src/ui/gui_widgets/gui_utxo_receive_widgets.c
@@ -919,7 +919,7 @@ static void GetChangePathLabelHint(char* hint, uint32_t maxLen)
{
switch (g_chainCard) {
case HOME_WALLET_CARD_BTC:
- snprintf_s(hint, maxLen, _("derivation_path_select_btc"));
+ snprintf_s(hint, maxLen, "%s", _("derivation_path_select_btc"));
return;
default:
break;
diff --git a/src/ui/gui_widgets/multi/gui_change_path_type_widgets.c b/src/ui/gui_widgets/multi/gui_change_path_type_widgets.c
index d430d67..a7456ea 100644
--- a/src/ui/gui_widgets/multi/gui_change_path_type_widgets.c
+++ b/src/ui/gui_widgets/multi/gui_change_path_type_widgets.c
@@ -409,14 +409,14 @@ static void GetChangePathLabelHint(char* hint)
switch (g_currentChain) {
#ifdef WEB3_VERSION
case HOME_WALLET_CARD_ETH:
- snprintf_s(hint, BUFFER_SIZE_128, _("derivation_path_select_eth"));
+ snprintf_s(hint, BUFFER_SIZE_128, "%s", _("derivation_path_select_eth"));
return;
case HOME_WALLET_CARD_SOL:
case HOME_WALLET_CARD_HNT:
- snprintf_s(hint, BUFFER_SIZE_128, _("derivation_path_select_sol"));
+ snprintf_s(hint, BUFFER_SIZE_128, "%s", _("derivation_path_select_sol"));
return;
case HOME_WALLET_CARD_ADA:
- snprintf_s(hint, BUFFER_SIZE_128, _("derivation_path_select_ada"));
+ snprintf_s(hint, BUFFER_SIZE_128, "%s", _("derivation_path_select_ada"));
return;
#endif
default:
diff --git a/src/ui/gui_widgets/multi/web3/gui_multi_path_coin_receive_widgets.c b/src/ui/gui_widgets/multi/web3/gui_multi_path_coin_receive_widgets.c
index d824357..a209359 100644
--- a/src/ui/gui_widgets/multi/web3/gui_multi_path_coin_receive_widgets.c
+++ b/src/ui/gui_widgets/multi/web3/gui_multi_path_coin_receive_widgets.c
@@ -645,17 +645,17 @@ static void GetChangePathLabelHint(char* hint)
{
switch (g_chainCard) {
case HOME_WALLET_CARD_ETH:
- snprintf_s(hint, BUFFER_SIZE_128, _("derivation_path_select_eth"));
+ snprintf_s(hint, BUFFER_SIZE_128, "%s", _("derivation_path_select_eth"));
break;
case HOME_WALLET_CARD_AVAX:
- snprintf_s(hint, BUFFER_SIZE_128, _("derivation_path_select_avax"));
+ snprintf_s(hint, BUFFER_SIZE_128, "%s", _("derivation_path_select_avax"));
break;
case HOME_WALLET_CARD_SOL:
case HOME_WALLET_CARD_HNT:
- snprintf_s(hint, BUFFER_SIZE_128, _("derivation_path_select_sol"));
+ snprintf_s(hint, BUFFER_SIZE_128, "%s", _("derivation_path_select_sol"));
break;
case HOME_WALLET_CARD_ADA:
- snprintf_s(hint, BUFFER_SIZE_128, _("derivation_path_select_ada"));
+ snprintf_s(hint, BUFFER_SIZE_128, "%s", _("derivation_path_select_ada"));
break;
default:
break;
Why this scored 32/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.