First iterative step to extend Fuzzing framework coverage on NBGL (nbgl page addon)#1625
Open
iartemov-ledger wants to merge 2 commits into
Open
First iterative step to extend Fuzzing framework coverage on NBGL (nbgl page addon)#1625iartemov-ledger wants to merge 2 commits into
iartemov-ledger wants to merge 2 commits into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1625 +/- ##
=======================================
Coverage 92.00% 92.00%
=======================================
Files 39 39
Lines 4653 4653
Branches 597 597
=======================================
Hits 4281 4281
Misses 258 258
Partials 114 114
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
6 tasks
N3ur0sis
force-pushed
the
aro/fuzzing-framework
branch
3 times, most recently
from
July 6, 2026 11:56
49b4056 to
7813e8c
Compare
iartemov-ledger
force-pushed
the
fuzzing-framework_nbgl_page_addon
branch
from
July 6, 2026 18:36
c2495ff to
4720cd5
Compare
N3ur0sis
force-pushed
the
aro/fuzzing-framework
branch
2 times, most recently
from
July 7, 2026 09:06
27b7984 to
338b423
Compare
iartemov-ledger
marked this pull request as draft
July 10, 2026 12:13
iartemov-ledger
force-pushed
the
fuzzing-framework_nbgl_page_addon
branch
5 times, most recently
from
July 17, 2026 08:54
156d307 to
4aed611
Compare
iartemov-ledger
changed the title
iartemov-ledger
marked this pull request as ready for review
July 17, 2026 08:57
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the SDK self-fuzzing (“Absolution”) coverage to NBGL page/layout construction and fixes a height-accounting underflow in nbgl_page rendering, improving robustness when building complex page contents.
Changes:
- Fixes a
uint16_tunderflow risk in NBGL page content layout by using a signedavailableHeight. - Adds a new
fuzz_nbgl_pageharness that exercises multiplenbgl_page*entry points with fuzzed content. - Registers the new fuzzer in the fuzz manifest and build system.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| lib_nbgl/src/nbgl_page.c | Switch availableHeight to signed to prevent underflow during layout height bookkeeping. |
| fuzzing/sdk-fuzz/harness/fuzz_nbgl_page.c | New fuzzer harness generating NBGL page content and invoking page constructors. |
| fuzzing/sdk-fuzz/fuzz-manifest.toml | Adds the fuzz_nbgl_page target and a small dictionary for seeding. |
| fuzzing/sdk-fuzz/CMakeLists.txt | Adds fuzz_nbgl_page to the fuzzer target list and build configuration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
iartemov-ledger
force-pushed
the
fuzzing-framework_nbgl_page_addon
branch
from
July 17, 2026 13:59
4aed611 to
e10e1e4
Compare
New sdk-fuzz target `fuzz_nbgl_page` exercising the NBGL page/layout
construction layer (lib_nbgl/src/nbgl_page.c + nbgl_layout.c). That layer is
compiled from source and instrumented, while the display/HAL layer stays
mocked (fuzzing/mock/nbgl).
The harness builds a fuzzed nbgl_pageContent_t from the input tail and drives
three entry points:
- nbgl_pageDrawGenericContent with 6 content types (TAG_VALUE_LIST,
SWITCHES_LIST, INFOS_LIST, CHOICES_LIST, BARS_LIST, CENTERED_INFO)
- nbgl_pageDrawInfo
- nbgl_pageDrawConfirmation
Strings are carved from the tail into a bounded pool and item arrays are
clamped. No new link deps: secure_sdk already pulls in nbgl + the HAL mock.
Found by SDK fuzzing (UBSan implicit-signed-integer-truncation): availableHeight is a uint16_t decremented by the height each list item consumes. When content is taller than the screen it underflows to a large value, defeating the `availableHeight > 10` guard meant to stop drawing separation lines near the bottom of the container. Make availableHeight signed (int) in addContent() and nbgl_pageDrawGenericContentExt(); the > 10 comparisons stay correct.
iartemov-ledger
force-pushed
the
fuzzing-framework_nbgl_page_addon
branch
from
July 17, 2026 14:01
e10e1e4 to
2c8bc15
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Changes include
Breaking changes
Please complete this section if any breaking changes have been made, otherwise delete it.
Additional comments
Please post additional comments in this section if you have them, otherwise delete it.
Auto cherry-pick in API_LEVEL
If requested to port the commits from this PR on a dedicated API_LEVEL branch,
select the targeted one(s), or add new references if not listed:
[x] TARGET_API_LEVEL: API_LEVEL_26
This will only create the PR with cherry-picks, ready to be reviewed and merged.
Remember: