fix: Out-of-bounds read in INS_SIGN freeze/unfreeze receiver handling via strlen on binary address

[cerberus-production]

Summary

Automated security fix for Out-of-bounds read in INS_SIGN freeze/unfreeze receiver handling via strlen on binary address (High).

CWE: CWE-CWE-125
OWASP: A03:2021-Injection
Fix Confidence: high

What Changed

Replaced two strlen((const char *) txContent.destination) > 0 checks with memcmp(txContent.destination, ZERO_ADDRESS, ADDRESS_SIZE) != 0. The destination field is a 21-byte binary Tron address (not NUL-terminated), so using strlen() causes an out-of-bounds read past the buffer. A static const zero-filled array ZERO_ADDRESS is used to compare against, which correctly detects whether a receiver address was set.

Caveats

• The fix assumes that an unset destination is always zero-initialized (all bytes 0x00). This is consistent with how initTx() works (memset to 0) and how the protobuf parser only writes to destination when the field is present.

Verification Checklist

• Review the code change
• Run tests to verify no regression
• Verify the vulnerability is addressed — already verified by Cerberus Sentinel

---

Created by Cerberus Merlin