Check return value of crypto_get_uncompressed_pubkey
What the developer wrote
Authored by Salvatore Ingala
Check return value of crypto_get_uncompressed_pubkey
Failures should not silently absorb errors.
What changed, and why it matters
This commit fixes a spot in the Ledger Bitcoin app where a function that converts a compressed public key to an uncompressed one was called without checking whether it succeeded. Before the fix, if the conversion failed, the code would keep going with potentially invalid data. After the fix, the function's return value is checked and the operation aborts with an error if something went wrong. The change is small and defensive, but it removes a silent-failure path in cryptographic key derivation.
Review crypto_get_uncompressed_pubkey to understand all failure conditions and confirm the fix is sufficient. Audit the codebase for other unchecked return values from crypto functions. Consider whether callers of bip32_CKDpub handle its -1 return value correctly. No immediate emergency action is indicated by the diff alone, but the patch should be included in the next release.
Security signals we found
Unchecked return value in cryptographic public-key decompression
Silent failure path in BIP32 child key derivation from extended public key
Potential use of uninitialized or invalid uncompressed public key buffer
Defensive hardening of error propagation in crypto code
Evidence from the diff
In src/crypto.c, bip32_CKDpub previously called crypto_get_uncompressed_pubkey(parent->compressed_pubkey, K_par) without inspecting its return value. The patch wraps the call in a conditional: if (0 > crypto_get_uncompressed_pubkey(…)) return -1. This ensures that failures during public-key decompression propagate up instead of being ignored. The surrounding code already checks other cryptographic operations (secp256k1_point_unsafe, cx_ecfp_add_point_no_throw), so this change makes error handling consistent.
Changed components
src/crypto.cbip32_CKDpub functioncrypto_get_uncompressed_pubkey functionInspect captured patch +1 / −1
### src/crypto.c
@@ -135,7 +135,7 @@ int bip32_CKDpub(const serialized_extended_pubkey_t *parent,
if (0 > secp256k1_point_unsafe(I_L, P)) return -1;
uint8_t K_par[65];
- crypto_get_uncompressed_pubkey(parent->compressed_pubkey, K_par);
+ if (0 > crypto_get_uncompressed_pubkey(parent->compressed_pubkey, K_par)) return -1;
// add K_par
if (CX_OK !=Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.