Zero output buffer for signatures on errors
What the developer wrote
Authored by Salvatore Ingala
Zero output buffer for signatures on errors
What changed, and why it matters
This commit fixes a security-sensitive cleanup bug in the Ledger Bitcoin app's signing code. When a cryptographic signing operation failed, the output buffer that would normally hold the signature was not being cleared. That means a partially computed or leftover value could be returned to the caller instead of a valid signature. The fix wipes the buffer to zero whenever an error occurs, ensuring no misleading or exploitable signature-like data is produced.
Treat as a low-to-moderate security hardening fix. Review whether any caller of the signing function uses the output buffer after a non-zero return, and verify that MAX_DER_SIG_LEN covers the full allocated buffer. Consider whether additional callers or similar functions need the same zeroization pattern.
Security signals we found
explicit_bzero used to clear sensitive output buffer on error path
previously returned -1 without sanitizing out buffer
comment explicitly states intent: 'never produce a valid signature on errors'
single-line patch in cryptographic signing routine
no CVE, advisory, or researcher attribution present in commit
Evidence from the diff
In src/crypto.c, the signature generation function now calls explicit_bzero(out, MAX_DER_SIG_LEN) before returning -1 on the error path. Previously, the buffer pointed to by out could retain intermediate or uninitialized bytes. Because callers may inspect or forward the buffer even when the function reports failure, returning non-zero contents could lead to incorrect behavior in downstream parsing, malleability checks, or transaction serialization. The change is defensive and aligns with secure coding practice for cryptographic outputs.
Changed components
src/crypto.ccryptographic signature generation error pathInspect captured patch +1 / −0
diff --git a/src/crypto.c b/src/crypto.c
index a6a8619..7754550 100644
--- a/src/crypto.c
+++ b/src/crypto.c
@@ -443,6 +443,7 @@ end:
if (error) {
// unexpected error when signing
+ explicit_bzero(out, MAX_DER_SIG_LEN); // never produce a valid signature on errors
return -1;
}
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.