fix(prodtest_emu): fix command list structure
What the developer wrote
Authored by cepetr
fix(prodtest_emu): fix command list structure
[no changelog]
What changed, and why it matters
This commit fixes a data structure bug in the production-test emulator for Trezor hardware wallets. The code previously stored a list of pointers to command definitions, but used the wrong size when growing the list and then dereferenced it incorrectly. The fix stores the command definitions directly in the list and uses the correct size. This is a straightforward bug fix in an internal testing tool; there is no direct evidence it is an exploitable security vulnerability.
Treat as a normal code-quality/bug-fix commit. Review whether the prior mismatch could have caused out-of-bounds access or command misrouting in emulator-based test workflows, but no urgent security response is indicated by the available evidence.
Security signals we found
Memory allocation size mismatch between pointer and struct types
Pointer indirection inconsistency in command table registration
Fix located in emulator-only production-test code path
Evidence from the diff
In core/embed/projects/prodtest/commands.c, under TREZOR_EMULATOR, the global _cmd_list was declared as const cli_command_t **_cmd_list (array of pointers). register_cli_command() allocated with sizeof(*_cmd_list) (pointer size) and assigned a pointer: _cmd_list[_cmd_count++] = cmd. The accessor commands_get_ptr() then returned *_cmd_list (dereferencing the first pointer). The patch changes _cmd_list to cli_command_t * (array of structs), allocates sizeof(cli_command_t), and copies the struct: _cmd_list[_cmd_count++] = *cmd. The accessor now simply returns _cmd_list. This corrects a type/size mismatch and removes an unnecessary level of indirection. The bug could have caused memory corruption or incorrect command lookup if sizeof(cli_command_t) differed from sizeof(cli_command_t *), but the commit itself does not frame this as a security issue and no exploit path is described.
Changed components
core/embed/projects/prodtest/commands.cTrezor production-test emulator CLI command registrationInspect captured patch +4 / −4
diff --git a/core/embed/projects/prodtest/commands.c b/core/embed/projects/prodtest/commands.c
index 528b6ebb7..00dd1c459 100644
--- a/core/embed/projects/prodtest/commands.c
+++ b/core/embed/projects/prodtest/commands.c
@@ -21,19 +21,19 @@
#ifdef TREZOR_EMULATOR
#include <stdlib.h>
-const cli_command_t **_cmd_list;
+cli_command_t *_cmd_list;
size_t _cmd_count;
void register_cli_command(const cli_command_t *cmd) {
- _cmd_list = realloc(_cmd_list, sizeof(*_cmd_list) * (_cmd_count + 1));
- _cmd_list[_cmd_count++] = cmd;
+ _cmd_list = realloc(_cmd_list, sizeof(cli_command_t) * (_cmd_count + 1));
+ _cmd_list[_cmd_count++] = *cmd;
}
#endif
const cli_command_t *commands_get_ptr(void) {
#ifdef TREZOR_EMULATOR
- return *_cmd_list;
+ return _cmd_list;
#else
extern cli_command_t _prodtest_cli_cmd_section_start;
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.