fix: Buffer overflow in home-screen plugin tagline formatting
The home-screen plugin tagline builder accumulated the FORMAT_PLUGIN template length and the caller-controlled caller_app->name length into a uint8_t. A sufficiently long caller name could wrap that accumulator, leading to an undersized allocation for g_tag_line and a subsequent snprintf overflow into adjacent memory across the on-device library-call trust boundary. Bound the plugin name with strnlen() against an explicit maximum and perform the length math in size_t to make the wrap unreachable. (cherry picked from commit 1191ba202dcef992614f68eb73c3d9080ec1ede5)
C
Charles-Edouard de la Vergne committed
d235754574bc8e93eb9a7d3b8ea239cefc545e63
Parent: b959d61
Committed by Alexandre Paillier <alexandre.paillier@ledger.fr>
on 8/25/2026, 3:03:55 PM