fix(nordic): size the bond list event buffer for a full bond table
What the developer wrote
Authored by tychovrahe
fix(nordic): size the bond list event buffer for a full bond table
management_send_bonds() writes an event byte, a bond count, and then one
seven-byte record per bond, but sized the buffer for the count plus the
records only. With CONFIG_BT_MAX_PAIRED=8 bonds present, the final byte of
the last record lands one past the end of a 57-byte array.
No attacker is involved - eight bonded devices and a bond list request are
enough. It has likely gone unnoticed because the stray byte falls into stack
alignment padding, which is the compiler's choice rather than a guarantee.
[no changelog]
What changed, and why it matters
This commit fixes a one-byte buffer overflow in the Trezor hardware wallet's Bluetooth code. When listing all paired Bluetooth devices, the software reserved a buffer that was one byte too small. If the maximum of eight devices were paired, the last byte of the last device's address would be written just past the end of the buffer. The commit message says no attacker is needed to trigger it; it can happen simply by requesting the bond list with eight bonded devices. The overflow is small and likely lands in harmless compiler padding, but it is still a real memory-safety bug.
Apply the patch. Consider adding a static assertion or compile-time size check tying the tx_data array size to the actual serialization logic, and review nearby management event handlers for similar off-by-one sizing errors.
Security signals we found
Stack buffer overflow (one byte)
Off-by-one allocation error
Memory corruption in Bluetooth management event path
No attacker input required; triggered by normal bond-list request with full bond table
Evidence from the diff
In nordic/trezor/trezor-ble/src/ble/ble_management.c, management_send_bonds() builds a BLE management event containing an event byte (1), a bond count byte (1), and one seven-byte record per bonded device (CONFIG_BT_MAX_PAIRED * (1 + BT_ADDR_SIZE), where BT_ADDR_SIZE is 6). The original buffer size was 1 + (8 * 7) = 57 bytes, but the actual payload needs 2 + (8 * 7) = 58 bytes. With a full bond table, tx_data[57] (the final byte of the last record) is written out of bounds. The patch increases the allocation to 2 + … to match the data written. This is a classic off-by-one stack buffer overflow, though the commit message characterizes it as not attacker-controlled and likely masked by stack alignment padding.
Changed components
nordic/trezor/trezor-ble/src/ble/ble_management.cmanagement_send_bonds()Bluetooth bond list event generationInspect captured patch +2 / −1
### nordic/trezor/trezor-ble/src/ble/ble_management.c
@@ -133,7 +133,8 @@ static void management_send_bonds(void) {
bt_addr_le_t addr_list[CONFIG_BT_MAX_PAIRED] = {0};
size_t bond_count = bonds_get_all(addr_list, CONFIG_BT_MAX_PAIRED);
- uint8_t tx_data[1 + (CONFIG_BT_MAX_PAIRED * (1 + BT_ADDR_SIZE))] = {0};
+ // Event byte and bond count, followed by one record per bond
+ uint8_t tx_data[2 + (CONFIG_BT_MAX_PAIRED * (1 + BT_ADDR_SIZE))] = {0};
tx_data[0] = INTERNAL_EVENT_BOND_LIST;
tx_data[1] = bond_count;Why this scored 45/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.