From 0cf21cdf73917e90e978842b4482285e838f8580 Mon Sep 17 00:00:00 2001
From: Alexandre Paillier <alexandre.paillier@ledger.fr>
Date: Mon, 18 Jul 2022 16:18:19 +0200
Subject: [PATCH] Better EIP-712 array error-handling on APDU parsing

---
 src_features/signMessageEIP712/typed_data.c | 5 +++++
 src_features/signMessageEIP712/typed_data.h | 3 ++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/src_features/signMessageEIP712/typed_data.c b/src_features/signMessageEIP712/typed_data.c
index 7b10b08..1589994 100644
--- a/src_features/signMessageEIP712/typed_data.c
+++ b/src_features/signMessageEIP712/typed_data.c
@@ -659,6 +659,11 @@ static bool set_struct_field_array(const uint8_t *const data,
             return false;
         }
         *array_level = data[(*data_idx)++];
+        if (*array_level > ARRAY_TYPES_COUNT)
+        {
+            apdu_response_code = APDU_RESPONSE_INVALID_DATA;
+            return false;
+        }
         switch (*array_level)
         {
             case ARRAY_DYNAMIC: // nothing to do
diff --git a/src_features/signMessageEIP712/typed_data.h b/src_features/signMessageEIP712/typed_data.h
index f8daa54..dd431f3 100644
--- a/src_features/signMessageEIP712/typed_data.h
+++ b/src_features/signMessageEIP712/typed_data.h
@@ -16,7 +16,8 @@
 typedef enum
 {
     ARRAY_DYNAMIC = 0,
-    ARRAY_FIXED_SIZE
+    ARRAY_FIXED_SIZE,
+    ARRAY_TYPES_COUNT
 }   e_array_type;
 
 typedef enum