fix(core/prodtest): fix error handling in `prodtest_tropic_get_access_credential()`
What the developer wrote
Authored by Ondřej Vejpustek
fix(core/prodtest): fix error handling in `prodtest_tropic_get_access_credential()`
What changed, and why it matters
This is a one-line bug fix in a Trezor hardware wallet factory/production testing tool. The function `prodtest_tropic_get_access_credential()` now jumps to cleanup code when it fails to retrieve a public key, instead of continuing to run as if nothing went wrong. Without the fix, the tool could keep processing and potentially leak or mishandle sensitive key material after an error. The affected code is in a production-test (manufacturing) program, not the main wallet firmware users interact with.
Treat as a low-to-moderate reliability/security fix. Verify that the cleanup path properly zeroes sensitive buffers and that no other prodtest commands have similar missing error exits. No urgent end-user action is required because this code is part of factory production testing, not the shipped wallet firmware.
Security signals we found
Missing error-path exit after a failed cryptographic key fetch
Potential use of invalid/uninitialized public key material in subsequent operations
Resource cleanup bypass before the fix
Production-test tooling only, not main firmware runtime
Evidence from the diff
In core/embed/projects/prodtest/cmd/prodtest_tropic.c, the function prodtest_tropic_get_access_credential() calls tropic_get_pubkey(tropic_public) and reports an error if it fails, but the original code did not return or branch to cleanup. It continued to use the uninitialized/zeroed tropic_public buffer in subsequent cryptographic operations. The patch adds goto cleanup; after the error message so that resources are released and the function exits cleanly on failure.
Changed components
core/embed/projects/prodtest/cmd/prodtest_tropic.cprodtest_tropic_get_access_credential()Tropic secure-element production-test commandInspect captured patch +1 / −0
diff --git a/core/embed/projects/prodtest/cmd/prodtest_tropic.c b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
index 32d550f3..8aa26142 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_tropic.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
@@ -873,6 +873,7 @@ static void prodtest_tropic_get_access_credential(cli_t* cli) {
curve25519_key tropic_public = {0};
if (!tropic_get_pubkey(tropic_public)) {
cli_error(cli, CLI_ERROR, "`tropic_get_tropic_pubkey()` failed");
+ goto cleanup;
}
uint8_t output[sizeof(unprivileged_private) + NOISE_TAG_SIZE] = {0};
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.