mirror of
https://github.com/apache/nuttx.git
synced 2026-08-14 00:43:13 +00:00
45c75f3bda
romfs_cachenode() tracked the allocated size of rn_child in a uint8_t while rn_count is a uint16_t. Past 256 entries the size wraps to zero, the grow condition rn_count == num - 1 can never be true again and the array is not reallocated: entries are written beyond the allocation, corrupting the heap. Track the allocated size in a size_t. Signed-off-by: raiden00pl <raiden00@railab.me> Assisted-by: Claude Code |
||
|---|---|---|
| .. | ||
| CMakeLists.txt | ||
| fs_romfs.c | ||
| fs_romfs.h | ||
| fs_romfsutil.c | ||
| Kconfig | ||
| Make.defs | ||