mirror of
https://github.com/apache/nuttx.git
synced 2026-09-28 15:54:57 +08:00
raiden00pl
45c75f3bda
romfs_cachenode() tracked the allocated size of rn_child in a uint8_t while rn_count is a uint16_t. Past 256 entries the size wraps to zero, the grow condition rn_count == num - 1 can never be true again and the array is not reallocated: entries are written beyond the allocation, corrupting the heap. Track the allocated size in a size_t. Signed-off-by: raiden00pl <raiden00@railab.me> Assisted-by: Claude Code