Change key_len parameter to consistently be size_t
What the developer wrote
Authored by Salvatore Ingala
Change key_len parameter to consistently be size_t
This avoids the risk of silent signed/unsigned type conversions.
What changed, and why it matters
This commit changes several function parameters from signed integers (int) to unsigned size values (size_t) in code that handles key lookups in cryptographic maps. The stated goal is to avoid silent conversions between signed and unsigned types, which can hide bugs. The change is defensive and does not by itself fix a confirmed exploitable vulnerability, but it removes a class of low-level risks that could contribute to memory-safety issues in a security-critical hardware wallet app.
Review all call sites of these functions to ensure key_len values are already non-negative and that no new size_t underflow or truncation issues are introduced. Consider adding static analysis rules to enforce size_t for length parameters project-wide. Treat this as preventive hardening rather than an urgent security patch.
Security signals we found
Signed/unsigned integer type conversion risk in length parameters
Defensive hardening in cryptographic map value handling
Memory-size parameter used for key length in hardware wallet code
No explicit vulnerability or exploit fixed in the visible diff
Evidence from the diff
The patch updates the key_len parameter type from int to size_t in six files implementing merkleized map value retrieval and streaming. These functions are part of the Ledger Bitcoin app’s handler library for PSBT and transaction parsing. The change is purely a type consistency refactor; no logic, bounds checks, or call sites are modified in the diff. The commit message explicitly frames this as avoiding ‘silent signed/unsigned type conversions.’
Changed components
src/handler/lib/get_merkleized_map_value.csrc/handler/lib/get_merkleized_map_value.hsrc/handler/lib/get_merkleized_map_value_hash.csrc/handler/lib/get_merkleized_map_value_hash.hsrc/handler/lib/stream_merkleized_map_value.csrc/handler/lib/stream_merkleized_map_value.hInspect captured patch +9 / −9
diff --git a/src/handler/lib/get_merkleized_map_value.c b/src/handler/lib/get_merkleized_map_value.c
index 039c2e5..8223edf 100644
--- a/src/handler/lib/get_merkleized_map_value.c
+++ b/src/handler/lib/get_merkleized_map_value.c
@@ -9,9 +9,9 @@
int call_get_merkleized_map_value(dispatcher_context_t *dispatcher_context,
const merkleized_map_commitment_t *map,
const uint8_t *key,
- int key_len,
+ size_t key_len,
uint8_t *out,
- int out_len) {
+ size_t out_len) {
// LOG_PROCESSOR(__FILE__, __LINE__, __func__);
uint8_t key_merkle_hash[32];
diff --git a/src/handler/lib/get_merkleized_map_value.h b/src/handler/lib/get_merkleized_map_value.h
index 68d5dd4..a5f8127 100644
--- a/src/handler/lib/get_merkleized_map_value.h
+++ b/src/handler/lib/get_merkleized_map_value.h
@@ -22,9 +22,9 @@
int call_get_merkleized_map_value(dispatcher_context_t *dispatcher_context,
const merkleized_map_commitment_t *map,
const uint8_t *key,
- int key_len,
+ size_t key_len,
uint8_t *out,
- int out_len);
+ size_t out_len);
/**
* Convenience shortcut to read a little-endian unsigned 32-bit int.
@@ -33,7 +33,7 @@ int call_get_merkleized_map_value(dispatcher_context_t *dispatcher_context,
static inline int call_get_merkleized_map_value_u32_le(dispatcher_context_t *dispatcher_context,
const merkleized_map_commitment_t *map,
const uint8_t *key,
- int key_len,
+ size_t key_len,
uint32_t *out) {
uint8_t result_raw[4];
diff --git a/src/handler/lib/get_merkleized_map_value_hash.c b/src/handler/lib/get_merkleized_map_value_hash.c
index ea1881f..52757b9 100644
--- a/src/handler/lib/get_merkleized_map_value_hash.c
+++ b/src/handler/lib/get_merkleized_map_value_hash.c
@@ -9,7 +9,7 @@
int call_get_merkleized_map_value_hash(dispatcher_context_t *dispatcher_context,
const merkleized_map_commitment_t *map,
const uint8_t *key,
- int key_len,
+ size_t key_len,
uint8_t out[static 32]) {
// LOG_PROCESSOR(__FILE__, __LINE__, __func__);
diff --git a/src/handler/lib/get_merkleized_map_value_hash.h b/src/handler/lib/get_merkleized_map_value_hash.h
index 030207d..09da7f4 100644
--- a/src/handler/lib/get_merkleized_map_value_hash.h
+++ b/src/handler/lib/get_merkleized_map_value_hash.h
@@ -19,5 +19,5 @@
int call_get_merkleized_map_value_hash(dispatcher_context_t *dispatcher_context,
const merkleized_map_commitment_t *map,
const uint8_t *key,
- int key_len,
+ size_t key_len,
uint8_t out[static 32]);
\ No newline at end of file
diff --git a/src/handler/lib/stream_merkleized_map_value.c b/src/handler/lib/stream_merkleized_map_value.c
index f5d79b5..57486b7 100644
--- a/src/handler/lib/stream_merkleized_map_value.c
+++ b/src/handler/lib/stream_merkleized_map_value.c
@@ -7,7 +7,7 @@
int call_stream_merkleized_map_value(dispatcher_context_t *dispatcher_context,
const merkleized_map_commitment_t *map,
const uint8_t *key,
- int key_len,
+ size_t key_len,
void (*len_callback)(size_t, void *),
void (*callback)(buffer_t *, void *),
void *callback_state) {
diff --git a/src/handler/lib/stream_merkleized_map_value.h b/src/handler/lib/stream_merkleized_map_value.h
index d9dbf47..f204452 100644
--- a/src/handler/lib/stream_merkleized_map_value.h
+++ b/src/handler/lib/stream_merkleized_map_value.h
@@ -17,7 +17,7 @@
int call_stream_merkleized_map_value(dispatcher_context_t *dispatcher_context,
const merkleized_map_commitment_t *map,
const uint8_t *key,
- int key_len,
+ size_t key_len,
void (*len_callback)(size_t, void *),
void (*callback)(buffer_t *, void *),
void *callback_state);
\ No newline at end of file
Why this scored 37/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.