fix(core): truncate BLE name before invoking `ble_enter_pairing_mode()`
What the developer wrote
Authored by Roman Zeyde
fix(core): truncate BLE name before invoking `ble_enter_pairing_mode()`
Also, truncate when calling `switch_on()`.
What changed, and why it matters
This commit fixes a bug in the Trezor hardware wallet's Bluetooth handling. Previously, the device name sent to the Bluetooth chip when entering pairing mode or switching Bluetooth on was not truncated to the maximum allowed length. This could cause the Bluetooth stack to receive an oversized name, potentially leading to unstable behavior, pairing failures, or memory corruption in the Bluetooth firmware. The fix ensures the name is shortened to the advertised-name limit before being passed along.
Treat as a low-to-moderate security hardening fix. Verify that ADV_NAME_LEN matches the BLE controller's maximum advertising name length and that prefix_utf8_bytes() does not split a multi-byte UTF-8 codepoint. Consider auditing other FFI call sites for similar missing length checks.
Security signals we found
Buffer-size limit enforcement added for untrusted-length string input
Direct unsafe FFI call replaced with safer wrapper that performs truncation
Changelog describes fix as 'Truncate device name on BLE pairing'
Two entry points (pairing and power-on) both patched for consistency
Evidence from the diff
The patch modifies core/embed/rust/src/trezorhal/ble/mod.rs so that pairing_mode() truncates the device name using prefix_utf8_bytes(name, ADV_NAME_LEN) before calling ffi::ble_enter_pairing_mode(), and switch_on() now routes through set_name() (which already truncates) instead of directly calling ffi::ble_set_name(). The changelog fragment says ‘Truncate device name on BLE pairing.’ The change is defensive: without truncation, a long UTF-8 device name could exceed the BLE advertising-name limit and lead to a buffer overflow, malformed advertisement, or undefined behavior in the BLE controller/HCI layer.
Changed components
core/embed/rust/src/trezorhal/ble/mod.rsBluetooth Low Energy (BLE) pairing and switch-on flowsffi::ble_enter_pairing_mode()ffi::ble_set_name() / set_name() wrapperInspect captured patch +3 / −1
diff --git a/core/.changelog.d/6710.fixed b/core/.changelog.d/6710.fixed
new file mode 100644
index 00000000..2aed62ae
--- /dev/null
+++ b/core/.changelog.d/6710.fixed
@@ -0,0 +1 @@
+Truncate device name on BLE pairing.
diff --git a/core/embed/rust/src/trezorhal/ble/mod.rs b/core/embed/rust/src/trezorhal/ble/mod.rs
index 63d0eb62..dc250d06 100644
--- a/core/embed/rust/src/trezorhal/ble/mod.rs
+++ b/core/embed/rust/src/trezorhal/ble/mod.rs
@@ -84,12 +84,13 @@ fn state() -> ffi::ble_state_t {
}
pub fn pairing_mode(name: &str) -> Result<(), Error> {
+ let name = prefix_utf8_bytes(name, ADV_NAME_LEN);
let res = unsafe { ffi::ble_enter_pairing_mode(name.as_ptr(), name.len()) };
res_to_result(res)
}
pub fn switch_on(name: &str) -> Result<(), Error> {
- unsafe { ffi::ble_set_name(name.as_ptr(), name.len()) };
+ set_name(name);
let res = unsafe { ffi::ble_switch_on() };
res_to_result(res)
}
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.