Skip to content

fix(network_info): oob read due to integer truncation #970

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bboilot-ledger merged 1 commit into from
Mar 25, 2026
Merged

fix(network_info): oob read due to integer truncation #970

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 17 additions & 5 deletions src/features/provide_network_info/network_icon.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,16 @@
#include <stdbool.h>
#include <stdint.h>
#include "apdu_constants.h"
#include "network_info.h"
#include "write.h"
#include "tlv_apdu.h"
#include "app_mem_utils.h"
#include "ui_utils.h"

#define P2_NETWORK_CONFIG 0x00
#define P2_NETWORK_ICON 0x01
#define P2_GET_INFO 0x02
#define P2_NETWORK_CONFIG 0x00
#define P2_NETWORK_ICON 0x01
#define P2_GET_INFO 0x02
#define NETWORK_ICON_HEADER_SIZE 8U

typedef struct {
uint16_t received_size;
Expand All @@ -31,13 +33,15 @@ static bool check_icon_header(const uint8_t *data, uint16_t length, uint16_t *bu
uint16_t width = 0;
uint16_t height = 0;
uint16_t expected_px = 0;
uint32_t payload_size = 0;
uint32_t total_size = 0;

// The chunk starts by the Image Header (8 Bytes):
// - Width (2 Bytes)
// - Height (2 Bytes)
// - BPP (1 Byte)
// - Img buffer size (3 Bytes)
if (length < 8) {
if (length < NETWORK_ICON_HEADER_SIZE) {
PRINTF("NETWORK_ICON header length mismatch (%d)!\n", length);
return false;
}
Expand All @@ -56,7 +60,15 @@ static bool check_icon_header(const uint8_t *data, uint16_t length, uint16_t *bu
PRINTF("NETWORK_ICON size mismatch (%dx%d)!\n", width, height);
return false;
}
*buffer_size = 8 + data[5] + (data[6] << 8) + (data[7] << 16);
payload_size =
((uint32_t) data[5]) | (((uint32_t) data[6]) << 8) | (((uint32_t) data[7]) << 16);
total_size = NETWORK_ICON_HEADER_SIZE + payload_size;
// The icon pipeline tracks buffer sizes as uint16_t, so reject non-representable headers.
if (total_size > UINT16_MAX) {
PRINTF("NETWORK_ICON length overflow (%lu)!\n", (unsigned long) total_size);
return false;
}
*buffer_size = (uint16_t) total_size;
return true;
}

Expand Down
Loading