What the developer wrote
Authored by Ilya Artemov
Fix partial_data_len=0 case
What changed, and why it matters
This commit fixes a missing check in the Ledger Bitcoin app. A function that streams a transaction 'preimage' (a piece of data used to authorize Bitcoin transactions) did not reject the case where the caller asks to stream zero bytes. The fix now returns an error if the requested chunk size is zero, preventing possible downstream confusion or unsafe behavior. The change is small and defensive; the commit message does not describe any active exploit or security incident.
Treat as a low-to-moderate hardening fix. Review callers of call_stream_preimage() to confirm that partial_data_len=0 cannot be reached from untrusted APDU input, and add regression tests for the zero-length case. No urgent patch deployment is indicated by the diff alone, but the fix should be included in the next release.
Security signals we found
Input-validation hardening for zero-length chunk request
Defensive fix in transaction preimage streaming path
No explicit security framing or CVE referenced in commit
Evidence from the diff
In src/handler/lib/stream_preimage.c, call_stream_preimage() validates that the total preimage length is at least 1 byte. The patch adds an additional guard: if partial_data_len (the size of the chunk requested to be streamed) is 0, the function returns -3 immediately. This closes a gap where a caller could request a zero-byte stream. The diff alone does not show how such a request would be triggered or what concrete failure it causes, but zero-length streaming is a classic edge case that can lead to infinite loops, skipped validation, or incorrect state updates in streaming parsers.
Changed components
src/handler/lib/stream_preimage.ccall_stream_preimage()Bitcoin transaction preimage streamingInspect captured patch +1 / −1
diff --git a/src/handler/lib/stream_preimage.c b/src/handler/lib/stream_preimage.c
index 58996ec..bf25cc4 100644
--- a/src/handler/lib/stream_preimage.c
+++ b/src/handler/lib/stream_preimage.c
@@ -36,7 +36,7 @@ int call_stream_preimage(dispatcher_context_t *dispatcher_context,
}
uint32_t preimage_len = (uint32_t) preimage_len_u64;
- if (preimage_len < 1) {
+ if (preimage_len < 1 || partial_data_len == 0) {
// at least the initial 0x00 prefix should be there
return -3;
}
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.