Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-10-23 14:58:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fs/romfs: fix node cache overflow in directories with >256 entries

Browse source 
romfs_cachenode() tracked the allocated size of rn_child in a uint8_t
while rn_count is a uint16_t. Past 256 entries the size wraps to zero,
the grow condition rn_count == num - 1 can never be true again and the
array is not reallocated: entries are written beyond the allocation,
corrupting the heap.

Track the allocated size in a size_t.

Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
This commit is contained in:
raiden00pl 2026-08-10 12:09:33 +02:00 • committed by Xiang Xiao
parent 46e0f6f698
commit 427ad36315
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
fs/romfs/fs_romfsutil.c
View file

@ -417,7 +417,7 @@ static int romfs_cachenode(FAR struct romfs_mountpt_s *rm,
char childname[NAME_MAX + 1];
uint32_t linkoffset;
uint32_t info;
uint8_t num = 0;
size_t num = 0;
size_t nsize;
int ret;