AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 27 Bitcoin

feat(core): update translation parser support for blob V2.

Public commit record

What the developer wrote

Authored by kopecdav

62/100 · Adequate
feat(core): update translation parser support for blob V2.

[no changelog]
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
The short version

What changed, and why it matters

This commit updates the Trezor firmware's translation (language) file parser to support a new version 2 format. It adds support for reading font kerning data (small spacing adjustments between letter pairs) and relaxes a strict check that previously rejected any trailing data after the font section. The change is a feature update, not a documented security fix, but it touches low-level binary parsing code where mistakes can create security risks.

Recommended action

Review the `KerningTable::new` length calculation and `align_to` usage for off-by-one or alignment issues, ensure `read_u16_prefixed_block` bounds are enforced before the unsafe cast, and confirm that V2 blobs cannot be accepted by older firmware that lacks this parser. Consider adding fuzzing or unit tests for malformed V2 blobs.

Security signals we found

01

New `unsafe` block using `align_to` on externally supplied translation blob data

02

Removal of trailing-data rejection (`payload_reader.remaining() > 0`) in `Translations::new`

03

Addition of new blob format version V2 (`TRTR02`)

04

New kerning table parsing with length-prefixed binary read and tuple reinterpretation

05

No changelog entry and no vendor security disclosure in commit message

Risk score

Why this scored 27/100

Our methodology →
Potential impact 5/30
Exploitability 6/25
Stealth signal 4/15
Affected reach 5/15
Confidence 4/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.