From a92b5fc333f47da17df47dd787e447b78e88d5c3 Mon Sep 17 00:00:00 2001
From: gabrielkerekes <gabriel.kerekes@vacuumlabs.com>
Date: Mon, 26 Apr 2021 12:45:56 +0200
Subject: [PATCH] fix(core/cardano): forbid tx outputs with both address and
 address parameters

---
 .../fixtures/cardano/sign_tx.failed.json      | 31 +++++++++++++++++++
 core/src/apps/cardano/sign_tx.py              |  6 ++++
 python/src/trezorlib/cardano.py               |  3 +-
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/common/tests/fixtures/cardano/sign_tx.failed.json b/common/tests/fixtures/cardano/sign_tx.failed.json
index 355dbcf6a..4a0af7855 100644
--- a/common/tests/fixtures/cardano/sign_tx.failed.json
+++ b/common/tests/fixtures/cardano/sign_tx.failed.json
@@ -401,6 +401,37 @@
         "error_message": "Invalid address"
       }
     },
+    {
+      "description": "Output has both address and address parameters set",
+      "parameters": {
+        "protocol_magic": 764824073,
+        "network_id": 1,
+        "fee": 42,
+        "ttl": 10,
+        "certificates": [],
+        "withdrawals": [],
+        "auxiliary_data": null,
+        "inputs": [
+          {
+            "path": "m/1852'/1815'/0'/0/0",
+            "prev_hash": "3b40265111d8bb3c3c608d95b3a0bf83461ace32d79336579a1939b3aad1c0b7",
+            "prev_index": 0
+          }
+        ],
+        "outputs": [
+          {
+            "address": "addr_test1vr9s8py7y68e3x66sscs0wkhlg5ssfrfs65084jrlrqcfqqtmut0e",
+            "addressType": 0,
+            "path": "m/1852'/1815'/0'/0/0",
+            "stakingPath": "m/1852'/1815'/0'/2/0",
+            "amount": "1"
+          }
+        ]
+      },
+      "result": {
+        "error_message": "Outputs can not contain both address and address_parameters fields!"
+      }
+    },
     {
       "description": "Certificate has non staking path",
       "parameters": {
diff --git a/core/src/apps/cardano/sign_tx.py b/core/src/apps/cardano/sign_tx.py
index 3b0bcc6b0..c843865c4 100644
--- a/core/src/apps/cardano/sign_tx.py
+++ b/core/src/apps/cardano/sign_tx.py
@@ -213,6 +213,12 @@ def _validate_outputs(
     total_amount = 0
     for output in outputs:
         total_amount += output.amount
+
+        if output.address_parameters and output.address is not None:
+            raise wire.ProcessError(
+                "Outputs can not contain both address and address_parameters fields!"
+            )
+
         if output.address_parameters:
             validate_address_parameters(output.address_parameters)
         elif output.address is not None:
diff --git a/python/src/trezorlib/cardano.py b/python/src/trezorlib/cardano.py
index afc379488..48a3d9fff 100644
--- a/python/src/trezorlib/cardano.py
+++ b/python/src/trezorlib/cardano.py
@@ -123,7 +123,8 @@ def parse_output(output) -> messages.CardanoTxOutputType:
 
     if contains_address:
         address = output["address"]
-    else:
+
+    if contains_address_type:
         address_parameters = _parse_address_parameters(output)
 
     if "token_bundle" in output: