What the developer wrote
Authored by ww3512687
fix crash
What changed, and why it matters
This commit fixes a memory-freeing mismatch in the Keystone 3 hardware wallet firmware. The code was freeing a memory block using the wrong allocator (EXT_FREE instead of SRAM_FREE). Such mismatches can corrupt memory and cause the device to crash or behave unpredictably. The commit title says 'fix crash,' but no further details are provided, and there is no independent evidence that this is exploitable for security harm rather than just a stability bug.
Treat as a stability fix with possible security side effects. Review the allocation site for jsonString to confirm it is always SRAM-allocated, audit other EXT_FREE/SRAM_FREE usages for similar mismatches, and consider fuzzing DeviceSettingsInit with malformed persisted settings. No immediate CVE is warranted based solely on this diff.
Security signals we found
Memory allocator mismatch (EXT_FREE vs SRAM_FREE)
Potential heap corruption / use-after-free
Crash fix in firmware initialization path
No explicit security context in commit message
Evidence from the diff
In src/device_settings.c, DeviceSettingsInit() previously called EXT_FREE(jsonString) to release a buffer that was allocated via the SRAM allocator. The patch changes the deallocation to SRAM_FREE(jsonString). Freeing memory through a mismatched heap/allocator can lead to heap metadata corruption, use-after-free, or a crash. The commit message only states ‘fix crash’ and does not describe an attack vector, security impact, or reporter.
Changed components
src/device_settings.cDeviceSettingsInit()Keystone 3 firmware memory managementInspect captured patch +1 / −1
diff --git a/src/device_settings.c b/src/device_settings.c
index 33d9e47..d37e2cd 100644
--- a/src/device_settings.c
+++ b/src/device_settings.c
@@ -143,7 +143,7 @@ void DeviceSettingsInit(void)
}
if (jsonString != NULL) {
- EXT_FREE(jsonString);
+ SRAM_FREE(jsonString);
}
InitBootParam();
Why this scored 30/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.