Summary
`eos_hashAuthorization()` writes the correct `waits_count` length prefix, then its element loop reads `for (size_t i = 0; i < auth->accounts_count; i++)` -- using `accounts_count` instead of `waits_count` as the bound while iterating `auth->waits[i]`.
Impact (high)
Send an authorization with `accounts_count=5, waits_count=0`. `confirmArbitraryAuthorization()`'s wait-confirmation loop is correctly bounded by `waits_count` and shows/confirms zero delay entries. But `eos_hashAuthorization()` still reads `auth->waits[0..4]` -- array slots this message never populated (nanopb doesn't touch slots beyond the decoded count) -- and hashes whatever stale/uninitialized bytes are there into the signed preimage, while the declared length prefix says 0. This both corrupts the serialization (declared count ≠ hashed element count) and signs data that was never shown on screen and never came from the current message.
Fix direction
Change the loop bound from `auth->accounts_count` to `auth->waits_count`.
Summary
`eos_hashAuthorization()` writes the correct `waits_count` length prefix, then its element loop reads `for (size_t i = 0; i < auth->accounts_count; i++)` -- using `accounts_count` instead of `waits_count` as the bound while iterating `auth->waits[i]`.
Impact (high)
Send an authorization with `accounts_count=5, waits_count=0`. `confirmArbitraryAuthorization()`'s wait-confirmation loop is correctly bounded by `waits_count` and shows/confirms zero delay entries. But `eos_hashAuthorization()` still reads `auth->waits[0..4]` -- array slots this message never populated (nanopb doesn't touch slots beyond the decoded count) -- and hashes whatever stale/uninitialized bytes are there into the signed preimage, while the declared length prefix says 0. This both corrupts the serialization (declared count ≠ hashed element count) and signs data that was never shown on screen and never came from the current message.
Fix direction
Change the loop bound from `auth->accounts_count` to `auth->waits_count`.