chore(ethereum): check array data length
What the developer wrote
Authored by Ioan Bizău
chore(ethereum): check array data length
[no changelog]
What changed, and why it matters
This commit adds a length check to a function that parses arrays of 256-bit unsigned integers in Ethereum transaction data. Previously, if the raw data was not a multiple of 32 bytes, the function would silently ignore leftover bytes at the end. The fix now raises an error instead. This could matter for 'clear signing' displays on a Trezor hardware wallet, where malformed data might otherwise be shown or processed in a misleading way. The commit message does not describe this as a security fix, and no exploit is demonstrated.
Treat as a low-to-moderate hardening improvement. Review whether other parse_*_array functions in the same file or related Ethereum decoding paths have the same missing length-check pattern. No urgent response is indicated by the diff alone, but the change should be included in the next firmware release.
Security signals we found
Input-length validation added to parser
Malformed/truncated array data now rejected instead of silently truncated
Ethereum transaction data parsing code affected
No changelog entry and commit labeled as chore
Evidence from the diff
In core/src/apps/ethereum/clear_signing.py, parse_uint256_array() previously sliced raw_data into 32-byte chunks without validating that len(raw_data) was divisible by 32. Any trailing bytes shorter than 32 bytes were simply dropped by the list comprehension. The patch adds a guard: if len(raw_data) % 32 != 0, it raises InvalidFunctionCall. This prevents parsing of truncated or malformed uint256 arrays during Ethereum clear-signing decoding. The change is small and defensive; it does not by itself prove an exploitable vulnerability exists, but it removes a parsing inconsistency that could affect downstream display or validation logic.
Changed components
core/src/apps/ethereum/clear_signing.pyEthereum clear signing parserparse_uint256_array functionInspect captured patch +2 / −0
diff --git a/core/src/apps/ethereum/clear_signing.py b/core/src/apps/ethereum/clear_signing.py
index 129d2367..41a86154 100644
--- a/core/src/apps/ethereum/clear_signing.py
+++ b/core/src/apps/ethereum/clear_signing.py
@@ -154,6 +154,8 @@ def parse_string(raw_data: memoryview) -> Value:
def parse_uint256_array(raw_data: memoryview) -> list[Value]:
+ if len(raw_data) % 32 != 0:
+ raise InvalidFunctionCall
return [
parse_uint256(raw_data[i * 32 : (i + 1) * 32])
for i in range(len(raw_data) // 32)
Why this scored 49/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.