What the developer wrote
Authored by matejcik
fix(python): allow THP session id 255
[no changelog]
What changed, and why it matters
This is a tiny one-line fix in the Python Trezor library that changes when a session ID counter wraps around. Previously, the counter reset before reaching 255, so session ID 255 could never be used. The fix allows 255 to be used as a valid session ID. This is a minor correctness/robustness improvement, not a clear security vulnerability.
No urgent action. Treat as a normal bugfix/correctness patch. Review THP session ID handling in firmware and other clients for consistency, but no security response is indicated by this commit alone.
Security signals we found
off-by-one logic correction in session ID allocation
THP session ID range now includes maximum valid value 255
Evidence from the diff
In python/src/trezorlib/thp/client.py, the session ID counter wrap condition was changed from >= 0xFF to > 0xFF. This means _session_id_counter can now take the value 255 (0xFF) before wrapping back to 1. The change aligns the code with the intended range of session IDs (1-255 inclusive) for the Trezor Host Protocol (THP). There is no direct evidence in the commit of a security bug, exploit, or attacker-controlled outcome.
Changed components
python/src/trezorlib/thp/client.pyTrezor Host Protocol (THP) session management in Python client libraryInspect captured patch +1 / −1
diff --git a/python/src/trezorlib/thp/client.py b/python/src/trezorlib/thp/client.py
index da08a5fa..8c240223 100644
--- a/python/src/trezorlib/thp/client.py
+++ b/python/src/trezorlib/thp/client.py
@@ -129,7 +129,7 @@ class TrezorClientThp(client.TrezorClient[ThpSession]):
return ThpSession(self, 0)
self._session_id_counter += 1
- if self._session_id_counter >= 0xFF:
+ if self._session_id_counter > 0xFF:
self._session_id_counter = 1
session = ThpSession(self, self._session_id_counter)
session.derive(passphrase, derive_cardano)
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.