Skip to content
This repository has been archived by the owner on Dec 20, 2023. It is now read-only.

fix: fix panic on Ledger derivation failure #13

Merged
merged 2 commits into from
Dec 9, 2022
Merged

fix: fix panic on Ledger derivation failure #13

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c70ad12
fix: fix panic on Ledger derivation failure
austinchandra Dec 8, 2022
abca562
Add release changelog entry
austinchandra Dec 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions usbwallet/ledger.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,14 +240,15 @@ func (w *ledgerDriver) ledgerDerive(derivationPath gethaccounts.DerivationPath)
return common.Address{}, nil, err
}

// #nosec G701 -- gosec will raise a warning on this integer conversion for potential overflow
replyFirstByteAsInt := int(reply[0])

// Verify public key was returned
if len(reply) < 1 || len(reply) < 1+replyFirstByteAsInt {
// #nosec G701 -- gosec will raise a warning on this integer conversion for potential overflow
if len(reply) < 1 || len(reply) < 1+int(reply[0]) {
return common.Address{}, nil, errors.New("reply lacks public key entry")
}

// #nosec G701 -- gosec will raise a warning on this integer conversion for potential overflow
replyFirstByteAsInt := int(reply[0])

pubkeyBz := reply[1 : 1+replyFirstByteAsInt]

publicKey, err := crypto.UnmarshalPubkey(pubkeyBz)
Expand All @@ -258,15 +259,16 @@ func (w *ledgerDriver) ledgerDerive(derivationPath gethaccounts.DerivationPath)
// Discard pubkey after fetching
reply = reply[1+replyFirstByteAsInt:]

// Reset first byte
// #nosec G701 -- gosec will raise a warning on this integer conversion for potential overflow
replyFirstByteAsInt = int(reply[0])

// Extract the Ethereum hex address string
if len(reply) < 1 || len(reply) < 1+replyFirstByteAsInt {
// #nosec G701 -- gosec will raise a warning on this integer conversion for potential overflow
if len(reply) < 1 || len(reply) < 1+int(reply[0]) {
return common.Address{}, nil, errors.New("reply lacks address entry")
}

// Reset first byte after discarding pubkey from response
// #nosec G701 -- gosec will raise a warning on this integer conversion for potential overflow
replyFirstByteAsInt = int(reply[0])

hexStr := reply[1 : 1+replyFirstByteAsInt]

// Decode the hex string into an Ethereum address and return
Expand Down