-
Notifications
You must be signed in to change notification settings - Fork 884
Closed
Description
The lfs_cache_zero will cause corruption if prog_size != read_size.
static inline void lfs_cache_zero(lfs_t *lfs, lfs_cache_t *pcache) {
// zero to avoid information leak
memset(pcache->buffer, 0xff, lfs->cfg->prog_size);
pcache->block = CACHE_BLOCK_MAGIC;
}
The lfs->cfg->prog_size is error here when prog_size != read_size, especially read_size<prog_size. When read_size<prog_size, the memset function will set part of memory that not belong to it to 0xff, this will cause secrious problem.
I have tested the bug on my board( stm32 + freertos 10.0.1 + littlefs 1.6)
Metadata
Metadata
Assignees
Labels
No labels