App hardening and Zemu test environment updates#235
Merged
chcmedeiros merged 11 commits intomainfrom Apr 17, 2026
Merged
Conversation
Ensure the parser reaches the end of the buffer after processing the root CBOR map. This prevents unverified data from being included in the signature hash without being displayed to the user.
Ensure that the number of rates, bounds, and tokens does not exceed predefined maximums during parsing to prevent unexpected behavior.
Require the account index (BIP44 component 2) to be hardened for both consensus and EVM-side paths. This prevents a potential silent address-enumeration primitive where a host could request addresses or signatures under non-BIP44 accounts without user confirmation.
Introduce a review-pending flag to gate incoming APDUs while a user review is active. This prevents concurrent APDUs (particularly over BLE) from mutating shared state like HD paths or buffers before a transaction is signed or rejected. Additionally, add bounds checks to path extraction functions to prevent potential buffer underflows.
Update the parser to require RFC 8949 canonical format and unique map keys. This ensures that non-canonical or duplicate-key inputs—which the chain-side serializer does not produce—are rejected before they can cause a discrepancy between the displayed transaction and the signed data.
Update the validation logic in tx_getItem to reject a display index equal to the total number of items. Because item indices are zero-based, an index equal to the item count is out of bounds.
Correct the size parameter in snprintf to bound the write against the remaining buffer space. Using the total buffer size instead of the remaining capacity could allow a write to spill past the end of the stack buffer as the offset increases.
Add NULL guards at the Rust FFI boundary to prevent undefined behavior when creating slices from raw pointers. Reject embedded NUL bytes in transaction handler fields to ensure the user-visible text matches the signed payload, preventing potential discrepancies during review. Ensure cryptographic error paths explicitly signal failure to trigger proper memory zeroization and prevent returning uninitialized signatures.
Upgrade @zondax/zemu, Jest, and other development dependencies. Update the Jest and TypeScript configurations to support ESM-to-CJS transformation for specific packages like `get-port` and ensure compatibility with the updated test runner. Additionally, refresh Zemu snapshots to align with the new dependency versions.
Add explicit parentheses around multiplication operands in stakingAmendCommissionSchedule display arithmetic so the `readability-math-missing-parentheses` check passes. Replace a stray `rlp_ok` comparison in `readBigInt` with the matching `parser_error_t` value `parser_ok`, fixing the `clang-diagnostic-enum-compare` warning. The other two `parse_field` callers in the same file already use `parser_ok`. Reformat the CBOR canonical-validation call in `_read` to a single line per the project `.clang-format` column limit.
chcmedeiros
force-pushed
the
improvements
branch
from
e39e4c5 to
3d11004
Compare
abenso
approved these changes
Apr 17, 2026
tdejoigny-ledger
added a commit
to LedgerHQ/app-oasis
that referenced
this pull request
Apr 22, 2026
App hardening and Zemu test environment updates (Zondax#235)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A batch of correctness and robustness improvements across the app and its host test environment:
tx_getItem's display-index guard; tighten the colon-separator write bound in the inner-field renderer.extern \"C\"entry point.