raiden00pl opened a new pull request, #19770: URL: https://github.com/apache/nuttx/pull/19770
## Summary `romfs_cachenode()` tracked the allocated size of `rn_child` in a `uint8_t` while `rn_count` is a `uint16_t`. Past 256 entries the size wraps to zero, the grow condition `rn_count == num - 1` can never be true again and the array is not reallocated: entries are written beyond the allocation, corrupting the heap. ## Impact fix heap corruption for CONFIG_FS_ROMFS_CACHE_NODE=y ## Testing intel64 kernel build with LTP enabled -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
