Merge pull request #566 from LedgerHQ/cev/fix-amountToString

Fix potential oob writes
LedgerHQ · Apr 12, 2024 · c6a909a · c6a909a
2 parents a27c984 + 5b905fe
commit c6a909a
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src_common/common_utils.c b/src_common/common_utils.c
@@ -199,8 +199,11 @@ bool amountToString(const uint8_t *amount,
     uint8_t amount_len = strnlen(tmp_buffer, sizeof(tmp_buffer));
     uint8_t ticker_len = strnlen(ticker, MAX_TICKER_LEN);
 
-    memcpy(out_buffer, ticker, MIN(out_buffer_size, ticker_len));
     if (ticker_len > 0) {
+        if (out_buffer_size <= ticker_len + 1) {
+            return false;
+        }
+        memcpy(out_buffer, ticker, ticker_len);
         out_buffer[ticker_len++] = ' ';
     }