jerpelea opened a new pull request, #19806: URL: https://github.com/apache/nuttx/pull/19806
## Summary romfs_cachenode() tracked the allocated size of rn_child in a uint8_t while rn_count is a uint16_t. Past 256 entries the size wraps to zero, the grow condition rn_count == num - 1 can never be true again and the array is not reallocated: entries are written beyond the allocation, corrupting the heap. Track the allocated size in a size_t. ## Impact RELEASE ## Testing CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
