fix(core): raise proper exception for unexpected message in pairing phase
What the developer wrote
Authored by matejcik
fix(core): raise proper exception for unexpected message in pairing phase
[no changelog]
What changed, and why it matters
This commit fixes a small but specific bug in how the Trezor hardware wallet handles unrecognized messages during its secure Bluetooth/USB pairing setup (called the 'pairing phase'). Previously, receiving an unexpected message type could trigger a low-level KeyError instead of the intended, safer 'UnexpectedMessage' error. The fix makes the device respond with the proper error so the pairing process fails cleanly rather than potentially leaking internal state or crashing awkwardly.
Treat as a low-risk hardening fix. Include in routine firmware updates. No urgent user action required. Review whether other THP contexts have similar unhandled KeyError paths.
Security signals we found
Unexpected message handling in security-critical pairing context
Internal exception (KeyError) replaced with protocol-level exception (UnexpectedMessage)
Potential information disclosure or state confusion from unhandled exception reduced
No changelog entry suggests minor/internal fix
Evidence from the diff
In core/src/trezor/wire/thp/pairing_context.py, the code now catches KeyError from protobuf.type_for_wire() during THP (Trezor Host Protocol) pairing and re-raises it as UnexpectedMessage. This aligns error handling with the rest of the message-processing pipeline and prevents an internal exception from propagating out of handle_message(). The change is narrow and defensive; it does not alter pairing cryptography or message schemas, only exception translation.
Changed components
core/src/trezor/wire/thp/pairing_context.pyTrezor Host Protocol (THP) pairing flowprotobuf message dispatch in pairing contextInspect captured patch +12 / −2
diff --git a/core/src/trezor/wire/thp/pairing_context.py b/core/src/trezor/wire/thp/pairing_context.py
index 9d06f43f..0e4466fa 100644
--- a/core/src/trezor/wire/thp/pairing_context.py
+++ b/core/src/trezor/wire/thp/pairing_context.py
@@ -4,7 +4,12 @@ from ubinascii import hexlify
from trezor import loop, protobuf, workflow
from trezor.wire import context, message_handler, protocol_common
from trezor.wire.context import UnexpectedMessageException
-from trezor.wire.errors import ActionCancelled, DataError, SilentError
+from trezor.wire.errors import (
+ ActionCancelled,
+ DataError,
+ SilentError,
+ UnexpectedMessage,
+)
from trezor.wire.protocol_common import Context, Message
from trezor.wire.thp import ChannelState, get_enabled_pairing_methods, ui
@@ -188,7 +193,12 @@ async def handle_message(
try:
# Find a protobuf.MessageType subclass that describes this
# message. Raises if the type is not found.
- req_type = protobuf.type_for_wire(pairing_ctx.message_type_enum_name, msg.type)
+ try:
+ req_type = protobuf.type_for_wire(
+ pairing_ctx.message_type_enum_name, msg.type
+ )
+ except KeyError:
+ raise UnexpectedMessage("Message unrecognized in pairing context")
# Try to decode the message according to schema from
# `req_type`. Raises if the message is malformed.
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.