EIP-712 fixes

src/features/provide_gating/cmd_get_gating.c

@@ -650,7 +650,6 @@ bool set_gating_warning(void) {
     uint8_t counter = 0;
 
     if (GATING == NULL) {
-        PRINTF("[GATING] Descriptor not received\n");
         return true;
     }
 

src/features/sign_message_eip712/field_hash.c

@@ -51,18 +51,16 @@ void field_hash_deinit(void) {
 static const uint8_t *field_hash_prepare(const s_struct_712_field *field_ptr,
                                          const uint8_t *data,
                                          uint8_t *data_length) {
-    cx_err_t error = CX_INTERNAL_ERROR;
-
     fh->remaining_size = __builtin_bswap16(*(uint16_t *) &data[0]);  // network byte order
     data += sizeof(uint16_t);
     *data_length -= sizeof(uint16_t);
     fh->state = FHS_WAITING_FOR_MORE;
     if (IS_DYN(field_ptr->type)) {
-        CX_CHECK(cx_keccak_init_no_throw(&global_sha3, 256));
+        if (cx_keccak_init_no_throw(&global_sha3, 256) != CX_OK) {
+            return NULL;
+        }
     }
     return data;
-end:
-    return NULL;
 }
 
 /**
@@ -169,7 +167,7 @@ static bool field_hash_domain_special_fields(const s_struct_712_field *field_ptr
 
     key = field_ptr->key_name;
     // copy contract address into context
-    if (strncmp(key, "verifyingContract", strlen(key)) == 0) {
+    if (strcmp(key, "verifyingContract") == 0) {
         switch (field_ptr->type) {
             case TYPE_SOL_ADDRESS:
                 if (data_length > sizeof(eip712_context->contract_addr)) {
@@ -195,7 +193,7 @@ static bool field_hash_domain_special_fields(const s_struct_712_field *field_ptr
         memcpy(eip712_context->contract_addr, data, data_length);
         explicit_bzero(&eip712_context->contract_addr[data_length],
                        sizeof(eip712_context->contract_addr) - data_length);
-    } else if (strncmp(key, "chainId", strlen(key)) == 0) {
+    } else if (strcmp(key, "chainId") == 0) {
         eip712_context->chain_id = u64_from_BE(data, data_length);
     }
     return true;

src/features/sign_message_eip712/filtering.c

@@ -323,10 +323,6 @@ bool filtering_discarded_path(const uint8_t *payload, uint8_t length) {
         return false;
     }
     path = (char *) &payload[offset];
-    offset += path_len;
-    if (offset < path_len) {
-        return false;
-    }
     if (!matches_backup_path(path, path_len, &path_offset)) {
         return false;
     }

src/features/sign_message_eip712/path.c

@@ -225,21 +225,20 @@ static bool feed_last_hash_depth(const uint8_t *hash) {
  */
 static bool push_new_hash_depth(bool init) {
     s_hash_ctx *hash_ctx;
-    cx_err_t error = CX_INTERNAL_ERROR;
 
     // allocate new hash context
     if (APP_MEM_CALLOC((void **) &hash_ctx, sizeof(*hash_ctx)) == false) {
         return false;
     }
     if (init) {
-        CX_CHECK(cx_keccak_init_no_throw(&hash_ctx->hash, 256));
+        if (cx_keccak_init_no_throw(&hash_ctx->hash, 256) != CX_OK) {
+            APP_MEM_FREE(hash_ctx);
+            return false;
+        }
     }
 
     list_push_back((list_node_t **) &g_hash_ctxs, (list_node_t *) hash_ctx);
     return true;
-end:
-    APP_MEM_FREE(hash_ctx);
-    return false;
 }
 
 /**
@@ -346,6 +345,7 @@ static bool path_update(bool skip_if_array, bool stop_at_array, bool do_typehash
     const s_struct_712 *struct_ptr;
     const s_struct_712_field *starting_field_ptr;
     const s_struct_712_field *field_ptr;
+    const s_struct_712_field *outer_field;
     const char *typename;
     uint8_t hash[KECCAK256_HASH_BYTESIZE];
 
@@ -360,10 +360,22 @@ static bool path_update(bool skip_if_array, bool stop_at_array, bool do_typehash
         // check if we meet one of the given conditions
         if (((field_ptr == starting_field_ptr) && skip_if_array) ||
             ((field_ptr != starting_field_ptr) && stop_at_array)) {
-            // only if it is the first iteration of that array depth
-            if ((path_struct->array_depths[path_struct->array_depth_count - 1].index == 0) &&
-                field_ptr->type_is_array) {
-                break;
+            if (field_ptr->type_is_array) {
+                // Stop descent unless this field is the currently-iterated outer array.
+                // In that case we must descend to set up the new struct hash context.
+                // For any nested inner array we stop here and let path_new_array_depth
+                // handle its own setup, so that it is captured at the right stack level.
+                bool is_outer_array = false;
+                if (path_struct->array_depth_count > 0) {
+                    outer_field = get_nth_field(
+                        NULL,
+                        path_struct->array_depths[path_struct->array_depth_count - 1].path_index +
+                            1);
+                    is_outer_array = (outer_field != NULL) && (outer_field == field_ptr);
+                }
+                if (!is_outer_array) {
+                    break;
+                }
             }
         }
         typename = get_struct_field_typename(field_ptr);
@@ -533,7 +545,6 @@ bool path_new_array_depth(const uint8_t *data, uint8_t length) {
     bool is_custom;
     uint8_t array_size;
     uint8_t array_depth_count_bak;
-    cx_err_t error = CX_INTERNAL_ERROR;
     s_hash_ctx *start_hash_ctx = get_last_hash_ctx();
 
     if (path_struct == NULL) {
@@ -596,14 +607,20 @@ bool path_new_array_depth(const uint8_t *data, uint8_t length) {
             if (array_size > 0) {
                 memcpy(&hash_ctx->hash, &prev_ctx->hash, sizeof(prev_ctx->hash));
             } else {
-                CX_CHECK(cx_keccak_init_no_throw((cx_sha3_t *) &hash_ctx->hash, 256));
+                if (cx_keccak_init_no_throw((cx_sha3_t *) &hash_ctx->hash, 256) != CX_OK) {
+                    return false;
+                }
+            }
+            if (cx_keccak_init_no_throw((cx_sha3_t *) &prev_ctx->hash, 256) != CX_OK) {
+                return false;
             }
-            CX_CHECK(cx_keccak_init_no_throw((cx_sha3_t *) &prev_ctx->hash, 256));
 
             hash_ctx = prev_ctx;
             prev_ctx = get_previous_hash_ctx(hash_ctx);
         }
-        CX_CHECK(cx_keccak_init_no_throw((cx_sha3_t *) &hash_ctx->hash, 256));
+        if (cx_keccak_init_no_throw((cx_sha3_t *) &hash_ctx->hash, 256) != CX_OK) {
+            return false;
+        }
     }
     if (array_size == 0) {
         do {
@@ -612,8 +629,6 @@ bool path_new_array_depth(const uint8_t *data, uint8_t length) {
     }
 
     return true;
-end:
-    return false;
 }
 
 /**

src/features/sign_message_eip712/type_hash.c

@@ -114,7 +114,9 @@ static bool get_struct_dependencies(s_struct_dep **first_dep, const s_struct_712
                 new_dep->s = arg_struct_ptr;
                 flist_push_back((flist_node_t **) first_dep, (flist_node_t *) new_dep);
                 // TODO: Move away from recursive calls
-                get_struct_dependencies(first_dep, arg_struct_ptr);
+                if (!get_struct_dependencies(first_dep, arg_struct_ptr)) {
+                    return false;
+                }
             }
         }
     }
@@ -154,15 +156,16 @@ static void delete_struct_dep(s_struct_dep *sdep) {
 bool type_hash(const char *struct_name, const uint8_t struct_name_length, uint8_t *hash_buf) {
     const void *struct_ptr;
     s_struct_dep *deps;
-    cx_err_t error = CX_INTERNAL_ERROR;
 
     if ((struct_ptr = get_structn(struct_name, struct_name_length)) == NULL) {
         PRINTF("Error: could not find EIP-712 struct \"");
         for (int i = 0; i < struct_name_length; ++i) PRINTF("%c", struct_name[i]);
         PRINTF("\" for type_hash\n");
         return false;
     }
-    CX_CHECK(cx_keccak_init_no_throw(&global_sha3, 256));
+    if (cx_keccak_init_no_throw(&global_sha3, 256) != CX_OK) {
+        return false;
+    }
     deps = NULL;
     if (!get_struct_dependencies(&deps, struct_ptr)) {
         return false;
@@ -185,6 +188,4 @@ bool type_hash(const char *struct_name, const uint8_t struct_name_length, uint8_
         return false;
     }
     return true;
-end:
-    return false;
 }

src/features/sign_message_eip712/typed_data.h

@@ -59,7 +59,6 @@ typedef struct struct_712 {
 
 const void *get_array_in_mem(const void *ptr, uint8_t *array_size);
 const char *get_string_in_mem(const uint8_t *ptr, uint8_t *string_length);
-const char *get_struct_field_custom_typename(const s_struct_712_field *field_ptr);
 const char *get_struct_field_typename(const s_struct_712_field *ptr);
 e_array_type struct_field_array_depth(const uint8_t *ptr, uint8_t *array_size);
 const s_struct_712 *get_struct_list(void);

src/features/sign_message_eip712/ui_logic.c

@@ -788,7 +788,7 @@ static bool update_calldata_value(const uint8_t *data,
                 data += CALLDATA_SELECTOR_SIZE;
                 length -= CALLDATA_SELECTOR_SIZE;
                 calldata_size -= CALLDATA_SELECTOR_SIZE;
-            } else if (calldata_info->selector_state == CALLDATA_INFO_PARAM_NONE) {
+            } else if (calldata_info->selector_state == CALLDATA_INFO_PARAM_SET) {
                 selector = calldata_info->selector;
             }
             if ((g_parked_calldata = calldata_init(calldata_size, selector)) == NULL) {

src/nbgl/ui_utils.c

@@ -71,17 +71,23 @@ bool ui_pairs_init(uint8_t nbPairs) {
  */
 bool ui_buffers_init(uint8_t title_len, uint8_t subtitle_len, uint8_t finish_len) {
     ui_buffers_cleanup();
-    // Allocate the Title message buffer
-    if (!APP_MEM_CALLOC((void **) &g_titleMsg, title_len)) {
-        goto error;
+    if (title_len > 0) {
+        // Allocate the Title message buffer
+        if (!APP_MEM_CALLOC((void **) &g_titleMsg, title_len)) {
+            goto error;
+        }
     }
-    // Allocate the SubTitle message buffer
-    if (!APP_MEM_CALLOC((void **) &g_subTitleMsg, subtitle_len)) {
-        goto error;
+    if (subtitle_len > 0) {
+        // Allocate the SubTitle message buffer
+        if (!APP_MEM_CALLOC((void **) &g_subTitleMsg, subtitle_len)) {
+            goto error;
+        }
     }
-    // Allocate the Finish message buffer
-    if (!APP_MEM_CALLOC((void **) &g_finishMsg, finish_len)) {
-        goto error;
+    if (finish_len > 0) {
+        // Allocate the Finish message buffer
+        if (!APP_MEM_CALLOC((void **) &g_finishMsg, finish_len)) {
+            goto error;
+        }
     }
 
     return true;