What the developer wrote
Authored by odudex
fix: pMofN QRs now deal with bytes data
What changed, and why it matters
This commit fixes two functions in Krux's QR code handling so they can accept raw bytes as input, not just text strings. Previously, if a QR part arrived as bytes, the code would crash when it tried to search for text patterns like 'of' or check for a leading 'p'. The fix simply decodes bytes to text before processing. There is no direct evidence this was a security vulnerability, but a crash in QR parsing could in principle be triggered by a malformed QR and might affect availability or error handling.
Treat as a routine robustness fix. Review whether other QR parsing paths also assume str input. If a malformed QR can crash the device, consider adding fuzz tests for bytes inputs and ensure exceptions are caught at the UI layer.
Security signals we found
Input-type handling bug fixed in QR parser
Potential denial-of-service via malformed QR causing exception
No explicit security claim in commit message or diff
Evidence from the diff
In src/krux/qr.py, parse_pmofn_qr_part() and detect_format() now call data.decode() when data is a bytes object. This prevents TypeError/crash when string methods (index(), startswith(), split()) are invoked on bytes. The change is defensive and small. The commit message frames it as a fix for pMofN QRs handling bytes data. No buffer overflow, injection, or cryptographic weakness is visible in the diff.
Changed components
src/krux/qr.py:parse_pmofn_qr_partsrc/krux/qr.py:detect_formatInspect captured patch +2 / −0
diff --git a/src/krux/qr.py b/src/krux/qr.py
index 3524878..b46f403 100644
--- a/src/krux/qr.py
+++ b/src/krux/qr.py
@@ -372,6 +372,7 @@ def find_min_num_parts(data, max_width, qr_format):
def parse_pmofn_qr_part(data):
"""Parses the QR as a P M-of-N part, extracting the part's content, index, and total"""
+ data = data.decode() if isinstance(data, bytes) else data
of_index = data.index("of")
space_index = data.index(" ")
part_index = int(data[1:of_index])
@@ -382,6 +383,7 @@ def parse_pmofn_qr_part(data):
def detect_format(data):
"""Detects the QR format of the given data"""
qr_format = FORMAT_NONE
+ data = data.decode() if isinstance(data, bytes) else data
try:
if data.startswith("p"):
header = data.split(" ")[0]
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.