SIGN IN SIGN UP

fix: Buffer overflow in home-screen plugin tagline formatting

The home-screen plugin tagline builder accumulated the FORMAT_PLUGIN
template length and the caller-controlled caller_app->name length into
a uint8_t. A sufficiently long caller name could wrap that accumulator,
leading to an undersized allocation for g_tag_line and a subsequent
snprintf overflow into adjacent memory across the on-device library-call
trust boundary.

Bound the plugin name with strnlen() against an explicit maximum and
perform the length math in size_t to make the wrap unreachable.

(cherry picked from commit 1191ba202dcef992614f68eb73c3d9080ec1ede5)
C
Charles-Edouard de la Vergne committed
d235754574bc8e93eb9a7d3b8ea239cefc545e63
Parent: b959d61
Committed by Alexandre Paillier <alexandre.paillier@ledger.fr> on 8/25/2026, 3:03:55 PM