refactor(core): scope `select_menu` layouts
What the developer wrote
Authored by Roman Zeyde
refactor(core): scope `select_menu` layouts
May be related to the following OOM:
https://github.com/trezor/trezor-firmware/actions/runs/24751684853/job/72416000050
[no changelog]
What changed, and why it matters
This is a tiny code cleanup that wraps a UI menu layout call in a Python `with` statement so the object is automatically cleaned up after use. The commit message suggests it may help prevent an out-of-memory (OOM) crash during automated tests, but it does not describe a security vulnerability and no exploit path is visible.
Treat as a routine defensive refactor. Review whether the OOM in CI is reproducible and whether other layout calls should be similarly scoped, but no immediate security response is indicated.
Security signals we found
Memory/resource lifecycle change (context manager scoping)
Commit message mentions possible relation to an OOM event
Evidence from the diff
The change converts a trezorui_api.select_menu(...) call into a context manager (with ... as layout:). This ensures the layout object is scoped and released promptly after interact() completes, rather than remaining referenced until the next loop iteration. The commit message links this to a possible OOM in CI. There is no direct evidence of a security bug, memory corruption, or attacker-controlled behavior.
Changed components
core/src/trezor/ui/layouts/menu.pyTrezor device UI menu flowInspect captured patch +4 / −3
diff --git a/core/src/trezor/ui/layouts/menu.py b/core/src/trezor/ui/layouts/menu.py
index 65cc4117..f26065b9 100644
--- a/core/src/trezor/ui/layouts/menu.py
+++ b/core/src/trezor/ui/layouts/menu.py
@@ -70,12 +70,13 @@ async def show_menu(
menu = menu.children[i]
if isinstance(menu, Menu):
- layout = trezorui_api.select_menu(
+ with trezorui_api.select_menu(
items=[child.name for child in menu.children],
current=current_item,
cancel=menu.cancel and menu.cancel.name,
- )
- choice = await interact(layout, br_name=None, raise_on_cancel=None)
+ ) as layout:
+ choice = await interact(layout, br_name=None, raise_on_cancel=None)
+
if choice is trezorui_api.CANCELLED:
if menu.cancel:
result = await menu.cancel.factory()
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.