Add missing length validation for V2 wallet policies
What the developer wrote
Authored by Salvatore Ingala
Add missing length validation for V2 wallet policies
With V2 wallet policies, the preimage of the wallet policy is
requested after the wallet poicy header, which already declares its
length. Therefore, the length of the preimage should always match.
Thanks to Rob Hamilton for the bug report.
What changed, and why it matters
This commit fixes a missing safety check in Ledger's Bitcoin app when handling newer 'V2 wallet policies.' The app was told in advance how long the wallet policy data should be, but it never verified that the actual data matched that length. The fix adds a simple comparison: if the lengths don't match, the app now rejects the request. The commit credits Rob Hamilton for reporting the bug, but no public security advisory or CVE is included in the materials.
Treat as a security hardening fix with possible memory-safety or parsing-integrity implications. Review whether the missing check could have led to out-of-bounds reads, truncated policy parsing, or unexpected behavior in downstream signing logic. No CVE or advisory is supplied; consider whether one should be requested from Ledger.
Security signals we found
Missing input length validation in cryptographic/security parsing path
Potential parsing desynchronization between header length field and actual preimage length
Fix explicitly credited to external bug reporter (Rob Hamilton)
Small, targeted patch in a single security-critical source file
Evidence from the diff
In src/handler/lib/policy.c, read_and_parse_wallet_policy() parses wallet policies. For V2 policies, the wallet header already contains descriptor_template_len, and the code separately obtains the actual descriptor_template_len from the preimage. Previously it did not compare these two values. The patch adds a length-mismatch check and returns an error if they differ. This prevents processing a wallet policy whose declared and actual descriptor template lengths disagree.
Changed components
Ledger Bitcoin appsrc/handler/lib/policy.cV2 wallet policy parsing pathInspect captured patch +3 / −0
diff --git a/src/handler/lib/policy.c b/src/handler/lib/policy.c
index cce9b24..21ee89d 100644
--- a/src/handler/lib/policy.c
+++ b/src/handler/lib/policy.c
@@ -348,6 +348,9 @@ int read_and_parse_wallet_policy(
if (descriptor_template_len < 0) {
return WITH_ERROR(-1, "Failed getting wallet policy descriptor template");
}
+ if ((size_t) descriptor_template_len != wallet_header->descriptor_template_len) {
+ return WITH_ERROR(-1, "Descriptor template length mismatch");
+ }
}
buffer_t policy_map_buffer =
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.