Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Audit security comments #202

Closed
6 tasks done
ajinkyaraj-23 opened this issue Feb 9, 2024 · 0 comments · Fixed by #203
Closed
6 tasks done

Fix Audit security comments #202

ajinkyaraj-23 opened this issue Feb 9, 2024 · 0 comments · Fixed by #203
Assignees
Labels
app::wallet issues relating to the wallet app

Comments

@ajinkyaraj-23
Copy link
Collaborator

ajinkyaraj-23 commented Feb 9, 2024

in app/src/apdu_sign.c : 486, buffer’s content as to be zeroized (i.e.,cleared). For this, only the buffer size was reset to zero. In doing so, the data persists in memory, with the risk of being read by another channel.

  • Reset the buffer and not just its size.
  • Initialize pressed_right in ui_stream.c and ui_stream_nbgl.c
  • Fix TODO/NOTE and other comments - check app/src/ui_stream_nbgl.c: 352-354 and app/src/globals.h: 122
  • Remove redundant check for global.step in app/src/apdu_sign.c : 486
  • <=0 check is not correct for unsigned int. Fix at app/src/parser/operation_parser.c: 418
  • fix printf format specifier incompatibility at app/src/apdu_sign.c : 585
@ajinkyaraj-23 ajinkyaraj-23 added the app::wallet issues relating to the wallet app label Feb 9, 2024
@ajinkyaraj-23 ajinkyaraj-23 self-assigned this Feb 9, 2024
@ajinkyaraj-23 ajinkyaraj-23 changed the title Reset buffer if we dont return the hash Fix Audit security comments Feb 9, 2024
@ajinkyaraj-23 ajinkyaraj-23 linked a pull request Feb 9, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
app::wallet issues relating to the wallet app
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant