fix(core): log sources without null termination
What the developer wrote
Authored by Martin Milata
fix(core): log sources without null termination
[no changelog]
What changed, and why it matters
This commit fixes a logging bug in Trezor firmware's debug console output. Previously, the code used a width specifier to print a log source name, which could read past the end of a string that isn't null-terminated. The fix switches to a precision specifier that respects the known length. This is a defensive correctness fix in debug-only logging code; there is no direct evidence it is exploitable as a security vulnerability.
Treat as a minor defensive fix. No urgent action required. If auditing, verify that all log_source_t definitions provide a correct name_len and that syslog output is not exposed to untrusted consumers.
Security signals we found
Potential out-of-bounds read in format string usage
Non-null-terminated string handling corrected
Debug-only code path
Evidence from the diff
In syslog_start_record(), the format string changed from %s to %.s. The old %s treats name_len as a minimum field width and reads source->name as a null-terminated string, potentially over-reading if name is not null-terminated. The new %.s treats name_len as a maximum precision/length, limiting how many bytes printf reads. The header comment was updated to document that name does not need to be null-terminated. This affects only debug console output, not device operation or secrets handling.
Changed components
core/embed/sys/dbg/syslog.ccore/embed/sys/inc/sys/logging.hInspect captured patch +3 / −2
diff --git a/core/embed/sys/dbg/syslog.c b/core/embed/sys/dbg/syslog.c
index bfb33edc..a42b57b7 100644
--- a/core/embed/sys/dbg/syslog.c
+++ b/core/embed/sys/dbg/syslog.c
@@ -153,7 +153,7 @@ bool syslog_start_record(const log_source_t* source, log_level_t level) {
int name_len = (int)MIN(source->name_len, INT32_MAX);
dbg_console_printf("%s%" PRIu32 ".%03" PRIu32 " " ESC_COLOR_SOURCE
- "%*s" ESC_COLOR_NORMAL " %s ",
+ "%.*s" ESC_COLOR_NORMAL " %s ",
eol, seconds, msec, name_len, source->name, level_str);
return true;
diff --git a/core/embed/sys/inc/sys/logging.h b/core/embed/sys/inc/sys/logging.h
index 63a62a80..ed78bd73 100644
--- a/core/embed/sys/inc/sys/logging.h
+++ b/core/embed/sys/inc/sys/logging.h
@@ -31,7 +31,8 @@ typedef enum {
/** Information about a source module */
typedef struct {
- /** Source module name shown in the logs */
+ /** Source module name shown in the logs (doesn't have to be NULL terminated)
+ */
const char* name;
/** Length of the module name in characters */
size_t name_len;
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.