d-bis/app-ethereum
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix multiple vulnerabilities

Browse Source
This commit is contained in:
Jorge Martins
2022-07-08 11:12:50 +02:00
parent 4eb7109b86
commit e0218520d8
20 changed files with 166 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
src_features/signTx/cmd_signTx.c
View File

@@ -12,43 +12,33 @@ void handleSign(uint8_t p1,
unsigned int *tx) {
UNUSED(tx);
parserStatus_e txResult;
uint32_t i;
if (os_global_pin_is_validated() != BOLOS_UX_OK) {
PRINTF("Device is PIN-locked");
THROW(0x6982);
}
if (p1 == P1_FIRST) {
if (dataLength < 1) {
PRINTF("Invalid data\n");
THROW(0x6a80);
}
if (appState != APP_STATE_IDLE) {
reset_app_context();
}
appState = APP_STATE_SIGNING_TX;
tmpCtx.transactionContext.pathLength = workBuffer[0];
if ((tmpCtx.transactionContext.pathLength < 0x01) ||
(tmpCtx.transactionContext.pathLength > MAX_BIP32_PATH)) {
PRINTF("Invalid path\n");
workBuffer = parseBip32(workBuffer, &dataLength, &tmpCtx.transactionContext.bip32);
if (workBuffer == NULL) {
THROW(0x6a80);
}
workBuffer++;
dataLength--;
for (i = 0; i < tmpCtx.transactionContext.pathLength; i++) {
if (dataLength < 4) {
PRINTF("Invalid data\n");
THROW(0x6a80);
}
tmpCtx.transactionContext.bip32Path[i] = U4BE(workBuffer, 0);
workBuffer += 4;
dataLength -= 4;
}
tmpContent.txContent.dataPresent = false;
dataContext.tokenContext.pluginStatus = ETH_PLUGIN_RESULT_UNAVAILABLE;
initTx(&txContext, &global_sha3, &tmpContent.txContent, customProcessor, NULL);
if (dataLength < 1) {
PRINTF("Invalid data\n");
THROW(0x6a80);
}
// EIP 2718: TransactionType might be present before the TransactionPayload.
uint8_t txType = *workBuffer;
if (txType >= MIN_TX_TYPE && txType <= MAX_TX_TYPE) {

4
src_features/signTx/logic_signTx.c
View File

@@ -282,8 +282,8 @@ static void get_public_key(uint8_t *out, uint8_t outLength) {
}
os_perso_derive_node_bip32(CX_CURVE_256K1,
tmpCtx.transactionContext.bip32Path,
tmpCtx.transactionContext.pathLength,
tmpCtx.transactionContext.bip32.path,
tmpCtx.transactionContext.bip32.length,
privateKeyData,
NULL);
cx_ecfp_init_private_key(CX_CURVE_256K1, privateKeyData, 32, &privateKey);

4
src_features/signTx/ui_common_signTx.c
View File

@@ -10,8 +10,8 @@ unsigned int io_seproxyhal_touch_tx_ok(__attribute__((unused)) const bagl_elemen
uint32_t tx = 0;
io_seproxyhal_io_heartbeat();
os_perso_derive_node_bip32(CX_CURVE_256K1,
tmpCtx.transactionContext.bip32Path,
tmpCtx.transactionContext.pathLength,
tmpCtx.transactionContext.bip32.path,
tmpCtx.transactionContext.bip32.length,
privateKeyData,
NULL);
cx_ecfp_init_private_key(CX_CURVE_256K1, privateKeyData, 32, &privateKey);