fix: Out-of-bounds read from unbounded NodeSeed.seed in prepared transaction signing

[donjon-cerberus-sandbox]

Summary

Automated security fix for Out-of-bounds read from unbounded NodeSeed.seed in prepared transaction signing (High).

CWE: CWE-CWE-125
OWASP: A03:2021-Injection
Fix Confidence: high

What Changed

Validated node seed presence and length before hashing in prepared transaction node parsing. Create nodes now reject malformed matching seeds, and exercise nodes now reject missing or malformed seeds before any 32-byte hash encoding can read past the protobuf allocation.

Caveats

• This change hardens the runtime parser path; the nanopb codegen boundary for NodeSeed.seed remains unconstrained in the current generated protobuf artifacts.

Verification Checklist

• Review the code change
• Run tests to verify no regression
• Verify the vulnerability is addressed — already verified by Cerberus Sentinel

---

Created by Cerberus Merlin

[agrojean-ledger]

Checking seed presence and length is warranted.

encode_hash on the seed unconditionally reads exactly SHA256_HASH_LEN bytes from whatever pointer is passed. So enforcing the length when decoding the serialized transaction is relevant.