A small fix with stack variables assignment
What the developer wrote
Authored by Ilya Artemov
A small fix with stack variables assignment
What changed, and why it matters
This commit fixes a small coding issue in the Ledger Bitcoin app's transaction-signing code. Two local variables that previously had no starting value are now initialized to zero. In some code paths, these variables could have been used before being set, which might lead to incorrect checks when validating special 'OP_RETURN' outputs used in cryptocurrency swaps. The change is defensive and reduces the risk of unpredictable behavior, but the commit message does not claim it fixes an active security bug.
Review the full control flow of execute_swap_checks() to confirm whether any path could read push_opcode_size or data_size before assignment. If a reachable path exists, treat this as a security fix and consider a security advisory. Regardless, merge the initialization change as a defensive hardening measure and add static-analysis rules to catch uninitialized locals in security-critical handlers.
Security signals we found
Uninitialized local variables in security-critical signing path
Variables used for size/length decisions in OP_RETURN swap validation
Defensive initialization of stack variables
No explicit security claim or CVE in commit message
Evidence from the diff
In src/handler/sign_psbt.c, execute_swap_checks() declares push_opcode_size and data_size as uninitialized size_t locals. The patch initializes both to 0. The variables are assigned inside conditional branches (2 <= second_byte <= 75, and later OP_PUSHDATA1/2 branches not shown in the diff). If none of those branches are taken, the variables would remain indeterminate. Initializing them prevents use of uninitialized stack values during subsequent OP_RETURN length validation, which could otherwise cause incorrect swap-policy decisions or information disclosure via side effects. The diff is minimal and does not show the full control flow, so the exact reachable path is not confirmed from the patch alone.
Changed components
src/handler/sign_psbt.cexecute_swap_checks()OP_RETURN output validation during swap signingInspect captured patch +2 / −2
diff --git a/src/handler/sign_psbt.c b/src/handler/sign_psbt.c
index 8c24c85..a2eca99 100644
--- a/src/handler/sign_psbt.c
+++ b/src/handler/sign_psbt.c
@@ -1085,8 +1085,8 @@ execute_swap_checks(dispatcher_context_t *dc, sign_psbt_state_t *st) {
}
uint8_t second_byte = opreturn_script[1];
- size_t push_opcode_size; // the length of the push opcode (1 or 2 bytes)
- size_t data_size; // the length of the actual data embedded in the OP_RETURN output
+ size_t push_opcode_size = 0; // the length of the push opcode (1 or 2 bytes)
+ size_t data_size = 0; // the length of the actual data embedded in the OP_RETURN output
if (2 <= second_byte && second_byte <= 75) {
push_opcode_size = 1;
data_size = second_byte;
Why this scored 36/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.