What the developer wrote
Authored by Martin Milata
refactor(legacy): XPUB buffer length
[no changelog]
What changed, and why it matters
This commit slightly enlarges two internal memory buffers used to hold extended public keys (XPUBs) in the Trezor legacy firmware. The change gives each buffer one extra byte, likely to ensure a null terminator can always fit after a maximum-length serialized key. It is a defensive hardening change rather than a fix for a confirmed exploitable bug, and the commit message calls it a refactor with no changelog.
Treat as a minor defensive hardening patch. Review whether XPUB_MAXLEN is defined consistently across the codebase and whether other callers of hdnode_serialize_public use similarly sized buffers. No urgent action is indicated unless additional analysis shows the previous buffer size caused an actual out-of-bounds write.
Security signals we found
Buffer size increased by one byte to accommodate potential null terminator
Change touches XPUB serialization paths in legacy firmware
No explicit security or vulnerability language in commit message
No CVE, advisory, or researcher attribution present in commit
Evidence from the diff
In legacy/firmware/fsm.c and legacy/firmware/fsm_msg_coin.h, two char arrays declared as char xpub[XPUB_MAXLEN] are changed to char xpub[XPUB_MAXLEN + 1]. The arrays are passed to hdnode_serialize_public, which writes a base58-check encoded serialized extended public key. The extra byte is presumably reserved for a terminating NUL, suggesting the previous declaration may have been one byte short for a full XPUB_MAXLEN payload plus terminator. The commit is tagged [no changelog] and titled ‘refactor(legacy): XPUB buffer length’.
Changed components
legacy/firmware/fsm.clegacy/firmware/fsm_msg_coin.hhdnode_serialize_public caller sitesTrezor legacy device XPUB display and export flowInspect captured patch +2 / −2
diff --git a/legacy/firmware/fsm.c b/legacy/firmware/fsm.c
index 6071ca54..6df9065a 100644
--- a/legacy/firmware/fsm.c
+++ b/legacy/firmware/fsm.c
@@ -331,7 +331,7 @@ static bool fsm_layoutAddress(const char *address, const char *desc,
default: { // show XPUBs
int index = (screen - 2) / 2;
int page = (screen - 2) % 2;
- char xpub[XPUB_MAXLEN] = {0};
+ char xpub[XPUB_MAXLEN + 1] = {0};
const HDNodeType *node_ptr = NULL;
if (multisig->nodes_count) { // use multisig->nodes
node_ptr = &(multisig->nodes[index]);
diff --git a/legacy/firmware/fsm_msg_coin.h b/legacy/firmware/fsm_msg_coin.h
index 8a331950..a8ac3bba 100644
--- a/legacy/firmware/fsm_msg_coin.h
+++ b/legacy/firmware/fsm_msg_coin.h
@@ -127,7 +127,7 @@ void fsm_msgGetPublicKey(const GetPublicKey *msg) {
}
if (coin->xpub_magic) {
- char tmp_xpub[XPUB_MAXLEN] = {0};
+ char tmp_xpub[XPUB_MAXLEN + 1] = {0};
hdnode_serialize_public(node, fingerprint, coin->xpub_magic, tmp_xpub,
sizeof(tmp_xpub));
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.