esp-idf

mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00

Files

Tomáš Rohlínek f9d3c54b3e fix(storage/fatfs): record non-applicable runZero 2026 CVEs in SBOM

Document the three runZero "Seven FatFs bugs" CVEs that require no source change
in this component, so vulnerability scanners have their disposition:

  - CVE-2026-6684: GPT partition-scan loop DoS. Already fixed upstream in R0.16,
    where test_gpt_header() caps the partition-entry count at 128.
  - CVE-2026-6686: read of uninitialized clusters after f_lseek() past EOF.
    Longstanding, behavioral; not a memory-safety defect and zero-filling every
    extended cluster is prohibitively costly on flash.
  - CVE-2026-6688: long-filename overflow in downstream callers. Not exposed in
    ESP-IDF; vfs_fat.c uses bounded copies and fname is bounded by FF_MAX_LFN.

Reference: https://www.runzero.com/blog/fatfs-bugs/

2026-07-06 14:40:51 +02:00

diskio

feat(fatfs): Added BDL support to FatFS component

2026-04-07 07:11:21 +02:00

fatfs_utils

Merge branch 'fix/python3.14_test_fatfsgen' into 'master'

2026-04-13 16:08:16 +02:00

host_test

fix(fatfs): fix a memory leak bug when FF_USE_DYN_BUFFER was enabled

2026-04-21 11:54:39 +08:00

port

fix(fatfs): remove incorrect retval description from void ff_mutex_delete