fix: Use local variable instead of macro parameter in concat_bytes_to_arr
What the developer wrote
Authored by Daniel
fix: Use local variable instead of macro parameter in concat_bytes_to_arr
What changed, and why it matters
This is a one-line fix inside an internal Rust helper macro. The macro was accidentally reading from the original macro parameter `$a` instead of the local copy `a` when filling the output buffer. In Rust macros, this kind of mismatch can cause surprising compile-time or expansion errors, or in some edge cases allow the macro to behave differently than intended. The change makes the macro consistently use the local variable it already created, which is a correctness and maintainability improvement. There is no direct evidence in the commit that this was a security vulnerability or that it is exploitable.
Treat as a normal correctness/maintenance fix. Review whether the macro is used in any security-sensitive constant construction (e.g., hashes, keys, addresses) and verify that the previous `$a` usage did not cause incorrect outputs in practice. No urgent security response is indicated by the available evidence.
Security signals we found
Macro hygiene inconsistency: macro parameter used directly instead of local binding
Potential for unexpected expansion or evaluation of macro argument
No explicit security claim in commit message or diff
Evidence from the diff
In internals/src/const_tools.rs, the concat_bytes_to_arr! macro declares local bindings a and b from the macro parameters $a and $b, then fills an output array. The patched line changes output[i] = $a[i]; to output[i] = a[i];, so the loop now reads from the local a rather than the macro argument directly. This is a hygiene/consistency fix: the rest of the macro uses a and b, and using $a here could lead to unexpected macro expansion behavior, repeated evaluation, or borrow/move issues depending on what expression is passed as $a. The commit message frames it purely as a fix, not as a security issue.
Changed components
internals/src/const_tools.rsconcat_bytes_to_arr macroInspect captured patch +1 / −1
diff --git a/internals/src/const_tools.rs b/internals/src/const_tools.rs
index bd4c7232..70e2b885 100644
--- a/internals/src/const_tools.rs
+++ b/internals/src/const_tools.rs
@@ -41,7 +41,7 @@ macro_rules! concat_bytes_to_arr {
let mut output = [0u8; $len];
let mut i = 0;
while i < a.len() {
- output[i] = $a[i];
+ output[i] = a[i];
i += 1;
}
while i < a.len() + b.len() {
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.