fix(core): avoid integer underflow in Caesar loader
What the developer wrote
Authored by Roman Zeyde
fix(core): avoid integer underflow in Caesar loader
Otherwise, it will panic when `debug_assert`s are enabled.
[no changelog]
What changed, and why it matters
This commit fixes a minor arithmetic bug in the star-shaped loading animation on Trezor hardware wallets. When the previous code calculated the position just before the currently selected star, it could subtract 1 from 0, causing an integer underflow. In Rust, this only triggers a panic when special debug checks are enabled, so normal user devices would not crash. The fix avoids the underflow by adding the total star count before subtracting one, then wrapping with modulo. It is a UI-only change with no direct security impact on funds or device secrets.
No urgent action required. Treat as a normal code-quality/UI fix. If auditing, confirm `STAR_COUNT` equals the prior hard-coded value (8) and that `sel_idx` is always less than `STAR_COUNT` so the new expression cannot overflow.
Security signals we found
Integer underflow in Rust UI code
Panic condition limited to debug builds
No input from untrusted sources observed
No memory corruption, privilege escalation, or secret exposure
Commit message frames issue as debug-assert panic, not security vulnerability
Evidence from the diff
In core/embed/rust/src/ui/layout_caesar/cshape/loader_starry.rs, the expression (sel_idx - 1) % 8 could underflow when sel_idx was 0, because sel_idx is an unsigned integer (usize). Rust’s debug builds panic on arithmetic underflow, while release builds wrap silently. The patch replaces the literal 8 with the named constant STAR_COUNT and rewrites the neighbor calculation as (sel_idx + STAR_COUNT - 1) % STAR_COUNT, which is mathematically equivalent for valid indices but avoids underflow. The commit message explicitly states the change prevents a panic when debug_asserts are enabled.
Changed components
core/embed/rust/src/ui/layout_caesar/cshape/loader_starry.rsTrezor firmware Caesar UI loader animationInspect captured patch +3 / −1
diff --git a/core/embed/rust/src/ui/layout_caesar/cshape/loader_starry.rs b/core/embed/rust/src/ui/layout_caesar/cshape/loader_starry.rs
index cfb364ac..84e42f70 100644
--- a/core/embed/rust/src/ui/layout_caesar/cshape/loader_starry.rs
+++ b/core/embed/rust/src/ui/layout_caesar/cshape/loader_starry.rs
@@ -85,7 +85,9 @@ impl Shape<'_> for LoaderStarry {
for (i, c) in STARS.iter().enumerate() {
if i == sel_idx {
self.draw_large_star(canvas, *c);
- } else if (sel_idx + 1) % 8 == i || (sel_idx - 1) % 8 == i {
+ } else if (sel_idx + 1) % STAR_COUNT == i
+ || (sel_idx + STAR_COUNT - 1) % STAR_COUNT == i
+ {
self.draw_medium_star(canvas, *c);
} else {
self.draw_small_star(canvas, *c);
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.