esp-idf

mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00

Files

T

Tomáš Rohlínek 0efd85ffea fix(storage/fatfs): reject empty exFAT cluster heap (CVE-2026-6683)

CVE-2026-6683 is an exFAT divide-by-zero: with NumClusters == 0 the filesystem
object has fs->n_fatent == 2, and the exFAT "percent in use" update in sync_fs()
computes ... * 100 / (fs->n_fatent - 2) -> division by zero.

That vulnerable exFAT PercInUse sync path was introduced in FatFs R0.16 and is
NOT present in this R0.15 release, so the divide-by-zero itself is not reachable
here. As defense-in-depth (and to keep parity with newer releases) reject an
empty exFAT cluster heap at mount time, which is a malformed volume regardless.

Record the CVE disposition in the component SBOM.

Reference: https://www.runzero.com/blog/fatfs-bugs/

2026-07-06 14:52:36 +02:00

diskio

Merge branch 'feat/remove_const_from_voltopart' into 'master'

2025-04-16 23:46:19 +08:00

fatfs_utils

fix(storage/fatfs): make wl_fatfsgen.py safe mode aware

2024-03-13 12:49:49 +01:00

host_test

fix(fatfs): fix a memory leak bug when FF_USE_DYN_BUFFER was enabled

2026-04-24 18:56:45 +08:00

port

fix(fatfs): remove incorrect retval description from void ff_mutex_delete