Merge pull request #185 from cosmos/dev

Dev

Author: chcmedeiros

.github/workflows/main.yml

@@ -16,4 +16,6 @@ jobs:
       runs-on: ${{ github.repository_owner == 'zondax' && 'zondax-runners' || 'ubuntu-latest' }}
       has-rust: false
       has-nanos: false
-      node-version: '22'
+      node-version: '22'
+    permissions:                                                            
+        contents: write  # Required for creating releases   

app/Makefile.version

@@ -3,4 +3,4 @@ APPVERSION_M=2
 # This is the `spec_version` field of `Runtime`
 APPVERSION_N=38
 # This is the patch version of this release
-APPVERSION_P=8
+APPVERSION_P=9

app/src/apdu_handler.c

@@ -221,12 +221,23 @@ __Z_INLINE void handleSign(volatile uint32_t *flags, volatile uint32_t *tx,
     THROW(APDU_CODE_DATA_INVALID);
   }
 
-  if (rx < VIEW_ADDRESS_OFFSET_SECP256K1) {
+  // Put address in output buffer, we will use it to confirm source address
+  zxerr_t zxerr = app_fill_address();
+  if (zxerr != zxerr_ok) {
+    *tx = 0;
+    THROW(APDU_CODE_DATA_INVALID);
+  }
+
+  // Safety: ensure response contains more than just pubkey
+  if (action_addrResponseLen <= PK_LEN_SECP256K1) {
+    *tx = 0;
     THROW(APDU_CODE_DATA_INVALID);
   }
+
   parser_tx_obj.tx_json.own_addr =
       (const char *)(G_io_apdu_buffer + VIEW_ADDRESS_OFFSET_SECP256K1);
-  parser_tx_obj.tx_json.own_addr_len = rx - VIEW_ADDRESS_OFFSET_SECP256K1;
+  parser_tx_obj.tx_json.own_addr_len =
+      action_addrResponseLen - PK_LEN_SECP256K1;
   const char *error_msg = tx_parse(sign_type);
   if (error_msg != NULL) {
     const int error_msg_length = strnlen(error_msg, sizeof(G_io_apdu_buffer));

app/src/json/json_parser.c

@@ -94,7 +94,7 @@ parser_error_t array_get_element_count(const parsed_json_t *json,
   }
 
   *number_elements = 0;
-  if (array_token_index > json->numberOfTokens) {
+  if (array_token_index >= json->numberOfTokens) {
     return parser_no_data;
   }
 
@@ -128,7 +128,7 @@ parser_error_t array_get_nth_element(const parsed_json_t *json,
     return parser_unexpected_value;
   }
 
-  if (array_token_index > json->numberOfTokens) {
+  if (array_token_index >= json->numberOfTokens) {
     return parser_no_data;
   }
 
@@ -167,7 +167,7 @@ parser_error_t object_get_element_count(const parsed_json_t *json,
   }
 
   *element_count = 0;
-  if (object_token_index > json->numberOfTokens) {
+  if (object_token_index >= json->numberOfTokens) {
     return parser_no_data;
   }
 
@@ -203,7 +203,7 @@ parser_error_t object_get_nth_key(const parsed_json_t *json,
   }
 
   *token_index = object_token_index;
-  if (object_token_index > json->numberOfTokens) {
+  if (object_token_index >= json->numberOfTokens) {
     return parser_no_data;
   }
 
@@ -242,7 +242,7 @@ parser_error_t object_get_nth_value(const parsed_json_t *json,
     return parser_unexpected_value;
   }
 
-  if (object_token_index > json->numberOfTokens) {
+  if (object_token_index >= json->numberOfTokens) {
     return parser_no_data;
   }
 
@@ -260,7 +260,7 @@ parser_error_t object_get_value(const parsed_json_t *json,
     return parser_unexpected_value;
   }
 
-  if (object_token_index > json->numberOfTokens) {
+  if (object_token_index >= json->numberOfTokens) {
     return parser_no_data;
   }
 

app/src/tx_display.c

@@ -694,7 +694,7 @@ parser_error_t tx_display_translation(char *dst, uint16_t dstLen, char *src,
   }
 
   if (src[srcLen - 1] == ' ' || src[srcLen - 1] == '@') {
-    if (src[dstLen - 1] + 1 > dstLen) {
+    if (count >= dstLen) {
       return parser_unexpected_value;
     }
     ASSERT_PTR_BOUNDS(count, dstLen);