From 427ad363156e7cb51cceaa2c0c598cf8db0d88a0 Mon Sep 17 00:00:00 2001 From: raiden00pl Date: Mon, 10 Aug 2026 12:09:33 +0200 Subject: [PATCH] fs/romfs: fix node cache overflow in directories with >256 entries romfs_cachenode() tracked the allocated size of rn_child in a uint8_t while rn_count is a uint16_t. Past 256 entries the size wraps to zero, the grow condition rn_count == num - 1 can never be true again and the array is not reallocated: entries are written beyond the allocation, corrupting the heap. Track the allocated size in a size_t. Signed-off-by: raiden00pl Assisted-by: Claude Code --- fs/romfs/fs_romfsutil.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/romfs/fs_romfsutil.c b/fs/romfs/fs_romfsutil.c index 600fa028cd1..fc081f61710 100644 --- a/fs/romfs/fs_romfsutil.c +++ b/fs/romfs/fs_romfsutil.c @@ -417,7 +417,7 @@ static int romfs_cachenode(FAR struct romfs_mountpt_s *rm, char childname[NAME_MAX + 1]; uint32_t linkoffset; uint32_t info; - uint8_t num = 0; + size_t num = 0; size_t nsize; int ret;