What the developer wrote
Authored by ww3512687
review forget password
What changed, and why it matters
This commit adds cleanup steps when the 'forget password' screen is closed. It now wipes a PIN buffer from memory and clears a secret cache. The change is defensive: it reduces the chance that a leftover PIN or secret remains in memory after the user leaves the password-recovery flow. The commit message does not say this fixes a specific vulnerability, and no public references were supplied.
Treat as a hardening improvement rather than a confirmed vulnerability. Review whether other widget de-init paths, error handlers, and power-off/timeout paths also clear g_pinBuf and the secret cache consistently. Consider static analysis for leftover secret buffers in the UI layer.
Security signals we found
Sensitive buffer cleared with memset_s in de-initialization path
Secret cache explicitly cleared on screen exit
Change is in password-recovery / PIN-handling UI widget
No explicit bug or CVE referenced in commit message
Evidence from the diff
In GuiForgetPassDeInit(), two lines were added: memset_s(g_pinBuf, sizeof(g_pinBuf), 0, sizeof(g_pinBuf)) and ClearSecretCache(). This ensures the local PIN buffer and any cached secrets are zeroed/invalidated when the forget-password widget is de-initialized. The patch is partial and small; it does not show whether other de-init paths, error paths, or earlier code already leaked the data, but it clearly improves secret hygiene for this screen.
Changed components
src/ui/gui_widgets/gui_forget_pass_widgets.cGuiForgetPassDeInit()g_pinBufsecret cacheInspect captured patch +2 / −0
diff --git a/src/ui/gui_widgets/gui_forget_pass_widgets.c b/src/ui/gui_widgets/gui_forget_pass_widgets.c
index 27d9582..6a20b3f 100644
--- a/src/ui/gui_widgets/gui_forget_pass_widgets.c
+++ b/src/ui/gui_widgets/gui_forget_pass_widgets.c
@@ -437,6 +437,8 @@ void GuiForgetPassDeInit(void)
DestroyPageWidget(g_pageWidget);
g_pageWidget = NULL;
}
+ memset_s(g_pinBuf, sizeof(g_pinBuf), 0, sizeof(g_pinBuf));
+ ClearSecretCache();
}
int8_t GuiForgetPassNextTile(uint8_t tileIndex)
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.