What the developer wrote
Authored by Ilya Artemov
Fixing uninitialized variable
What changed, and why it matters
This commit fixes a coding bug in the Ledger Bitcoin app where a variable that tracks whether cryptographic operations succeeded was not initialized before use. Because the function is marked as unsafe for secret data (it is vulnerable to timing attacks) and is now also made private to the file, the patch both removes a potential source of incorrect error handling and limits how widely the unsafe helper can be called. The actual security impact is moderate: on its own this is a defensive fix rather than a demonstrated exploit, but uninitialized error variables can in principle lead to wrong decisions downstream if an error path is taken before the variable is set.
Treat as a defensive hardening patch. Review whether any released firmware binaries included the uninitialized-variable version, and consider whether downstream callers of cx_ecfp_scalar_mult_unsafe rely on precise error codes. No emergency response is indicated by the commit alone, but the fix should be included in the next release.
Security signals we found
Uninitialized local variable in error-handling path
Function explicitly documented as unsafe for private data (timing-attack vulnerable)
Function scoped from global to static, reducing attack surface
No explicit security advisory, CVE, or exploit details in commit
Evidence from the diff
In src/crypto.c, cx_ecfp_scalar_mult_unsafe() had a local cx_err_t error that was declared without initialization. The function uses the CX_CHECK macro, which assigns error and jumps to cleanup on failure. If the first CX_CHECK call itself failed, error would still contain stack garbage, so the subsequent cx_bn_unlock(error) and return could propagate an undefined value. The patch sets error = CX_OK at declaration and additionally makes the function static, restricting linkage to crypto.c. This is a hardening fix; no exploit or specific failure path is demonstrated in the commit materials.
Changed components
src/crypto.ccx_ecfp_scalar_mult_unsafe()scalar multiplication helper used in Bitcoin app cryptographyInspect captured patch +5 / −2
diff --git a/src/crypto.c b/src/crypto.c
index 8f4792a..58cff67 100644
--- a/src/crypto.c
+++ b/src/crypto.c
@@ -49,10 +49,13 @@ const uint8_t BIP0341_tapleaf_tag[] = {'T', 'a', 'p', 'L', 'e', 'a', 'f'};
// Copy of cx_ecfp_scalar_mult_no_throw, but without using randomization for the scalar
// multiplication. Therefore, it is faster, but not safe to use on private data, as it is vulnerable
// to timing attacks.
-cx_err_t cx_ecfp_scalar_mult_unsafe(cx_curve_t curve, uint8_t *P, const uint8_t *k, size_t k_len) {
+static cx_err_t cx_ecfp_scalar_mult_unsafe(cx_curve_t curve,
+ uint8_t *P,
+ const uint8_t *k,
+ size_t k_len) {
size_t size;
cx_ecpoint_t ecP;
- cx_err_t error;
+ cx_err_t error = CX_OK;
CX_CHECK(cx_ecdomain_parameters_length(curve, &size));
CX_CHECK(cx_bn_lock(size, 0));
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.