(nuttx) branch master updated: fs/romfs: fix node cache overflow in directories with >256 entries

[xiaoxiang]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 45c75f3bda6 fs/romfs: fix node cache overflow in directories with >256 
entries
45c75f3bda6 is described below

commit 45c75f3bda61323b6dde58ac03b454e18b1a036a
Author: raiden00pl <raide...@railab.me>
AuthorDate: Mon Aug 10 12:09:33 2026 +0200

    fs/romfs: fix node cache overflow in directories with >256 entries
    
    romfs_cachenode() tracked the allocated size of rn_child in a uint8_t
    while rn_count is a uint16_t. Past 256 entries the size wraps to zero,
    the grow condition rn_count == num - 1 can never be true again and the
    array is not reallocated: entries are written beyond the allocation,
    corrupting the heap.
    
    Track the allocated size in a size_t.
    
    Signed-off-by: raiden00pl <raide...@railab.me>
    Assisted-by: Claude Code
---
 fs/romfs/fs_romfsutil.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/romfs/fs_romfsutil.c b/fs/romfs/fs_romfsutil.c
index 600fa028cd1..fc081f61710 100644
--- a/fs/romfs/fs_romfsutil.c
+++ b/fs/romfs/fs_romfsutil.c
@@ -417,7 +417,7 @@ static int romfs_cachenode(FAR struct romfs_mountpt_s *rm,
   char childname[NAME_MAX + 1];
   uint32_t linkoffset;
   uint32_t info;
-  uint8_t num = 0;
+  size_t num = 0;
   size_t nsize;
   int ret;