fix(prodtest): fix secrets-certdev-write arg count check
What the developer wrote
Authored by cepetr
fix(prodtest): fix secrets-certdev-write arg count check
What changed, and why it matters
This commit fixes a command in Trezor's production-test firmware that checks how many arguments a user passed. The old check rejected commands with more than zero arguments, but accidentally allowed commands with zero arguments through. The fix requires exactly one argument. The affected command is part of a low-level factory/testing tool, not the normal wallet firmware users run every day.
Treat as a low-severity correctness fix. If prodtest firmware is deployed to devices, ensure this patch is included before any use of secrets-certdev-write. No immediate end-user action is needed because prodtest is not the shipping wallet firmware.
Security signals we found
Incorrect argument-count validation in a secrets/certificate-writing command
Potential out-of-bounds or uninitialized argument access when zero arguments are supplied
Fix located in production-test firmware, not main wallet firmware
Evidence from the diff
In core/embed/projects/prodtest/cmd/prodtest_secrets.c, prodtest_secrets_certdev_write() previously used if (cli_arg_count(cli) > 0) to validate argument count. That logic only rejects calls with extra arguments; a call with zero arguments bypasses the check and proceeds. The patch changes the condition to != 1, enforcing exactly one argument. The command writes a device certificate in the production-test (prodtest) environment.
Changed components
core/embed/projects/prodtest/cmd/prodtest_secrets.cprodtest secrets-certdev-write CLI commandInspect captured patch +2 / −1
diff --git a/core/embed/projects/prodtest/.changelog.d/5604.fixed b/core/embed/projects/prodtest/.changelog.d/5604.fixed
new file mode 100644
index 000000000..561a99c0a
--- /dev/null
+++ b/core/embed/projects/prodtest/.changelog.d/5604.fixed
@@ -0,0 +1 @@
+Fixed arguments count check in the secrets-certdev-write command.
diff --git a/core/embed/projects/prodtest/cmd/prodtest_secrets.c b/core/embed/projects/prodtest/cmd/prodtest_secrets.c
index 176353cd5..8e0ba1920 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_secrets.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_secrets.c
@@ -163,7 +163,7 @@ cleanup:
}
static void prodtest_secrets_certdev_write(cli_t* cli) {
- if (cli_arg_count(cli) > 0) {
+ if (cli_arg_count(cli) != 1) {
cli_error_arg_count(cli);
return;
}
Why this scored 37/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.